December 2003 - cypherpunks-legacy

Re: Compressed data vulnerable to known-plaintext?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Someone who claimed to be Mark M. said on Sat, 1 Jun 1996: (I said:) > > Why not simply use two session keys, and encrypt the headers with one > > while encrypting the actual data with the other? That seems to solve both > > problems, except that more CPU cycles are required. > > An easier solution would be to just strip of the headers. If the header is > always the same, then it is redundant. If it varies, then it cannot be used > as known-plaintext. But then you still have the problem of identifying the contents. If there were no headers, one could not tell if the message was compressed using ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor, or even if it was left alone. One could also not tell if the decryption happened successfully. ( * Yes, I know tar is not compression. )

2 1

RISKS: Pachinko card counterfeit background
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Tue, 28 May 1996 22:09:28 +0900 (JST) From: Chiaki Ishikawa <ishikawa(a)personal-media.co.jp> Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15) I would like to add some background as someone who has played in pachinko parlors in Japan. (The origin of the game of pachinko is rather vague. Some say it is based on the ball game popular after the WW-II in U.S.A.. Anyway, it is a gambling business.) The card in question acts as a kind of debit card inside the pachinko parlors. It was introduced a few years ago by an former police official, with the expressed intention of keeping the money flow easy to track. (I would say it was a ruse to make a few companies where the ex-police officials can find jobs after retirement from the office. But I digress.) The cards are sold to the pachinko parlors and the customers buy the cards from the parlors, and obtain steel balls to play the game by inserting the card into the slot next to the game machine. Pachinko gambling works as follows. When you win the game, the number of steel balls in your possession increases and the customer can exchange the balls with gifts. (Therein lies a complication. Japanese law prohibits gambling, and so exchanging the steel balls with real money is illegal. *However*, first exchanging the balls with gifts, and then exchanging the gifts with money at a third party outlet [which is quite likely to be operated by the parlor owner] has been allowed by the police.) Speaking of loophole! Some people do bring back the gifts to homes: depending on the places, parlors carry game-boy cartridges, latest bestseller books, snack food such as cookies, instant noodles, umbrella, purse, movie video tape, music CD, to name a few as gifts. But if the customer wants to exchange his/her win indirectly to money at the outlet, then he/she has to ask for special gifts used essentially as money tokens by these establishments. These are often a tiny gold/silver foil embedded in thin plastic slab, etc.. Each parlor/outlet pair uses different stuff. In my hometown, a special brand of silk stocking was used as money token. This whole thing is a farce in view of the anti-gambling law in Japan.) Back to the card: the cards in question are used by two leading card manufacturers. (There are another couple of late-entry companies whose cards are not known to be attacked yet.) The card is based on the design done by NTT Data. NTT is the Japanese equivalent of old Ma Bell in the USA. NTT Data is a company that specializes in computer software integration, communication and such. I believe it designs the telephone card (debit card used for pay-phone in Japan), too. The pachinko card is the size of name card and plastic. The details are not published. To the best of my knowledge, I think there is a magnetic strip that contains the card ID information such as its serial number and the amount of debit money. There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards. (I said "were" because 10,000 yen and 5,000 yen cards are no longer available.) Attack method: >From what I saw and read, the first card verification mechanism used by the pachinko game machine was so primitive to defy rational explanation: each time the card was used, a tiny hole was punched to indicate the amount left in the card. As the customer uses the card, the position of the punched hole on card shifts toward the zero position. Once there is a hole on the zero position, the card is no longer usable. The first simple attack as far as I can tell was to fill in the hole in the card with tiny plastic (essentially the chaff produced when the hole is punched was used to fill in the hole). I am not sure if such simple attack was possible, but it seemed possible really at the beginning with crude modification of the magnetic data. Then, of course, the magnetic information on the card was also modified in more sophisticated ways when the card was used. However, the bad people also learned and somebody stole the reader mechanism and figure out the part of the magnetically-coded information: the result was that bad people could buy the pristine 10,000 yen card and then uses up to 2500 yen of the debit amount legally and then "re-fill" the card to 9500 yen worth, thus gaining 2000 yen for free again and again. (Until 3000 yen was used from the 10,000 yen card, the physical hole was not produced on the card, and only the magnetic information was changed. Hence the mere counterfeiting of the magnetic information was necessary to "revive" the card. No physical re-filling of the card was necessary. Physically re-filling the hole is easy to spot visually and was avoided by the bad guys.) [I have to confess that the exact amount involved in the counterfeiting is a little uncertain. But the general idea still holds.] Similar attack was possible with 5,000 yen card. Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was small compared with the risk, the bad guys didn't attack these cards until lately. Now the situation is that of cats and mouse. New counterfeiting methods and counter-measures follow each other in rapid succession. I believe that the cloning of the card was also done. But I don't know the details. Now, the card companies and pachinko parlors stopped issuing 10,000 yen and 5,000 yen cards because the damage was so large. Also, they have installed special readers to verify the validity of the card by incorporating more vigourous checking not available on the readers next to the game machine: it used to be that the cards sold could by used by any pachinko parlors in Japan. Now cards sold elsewhere have to be verified with this machine before used at a local game parlor. Cards sold at the local parlor can be used without such checking. Already, there are reports of counterfeit-card usage: - either the cards are so sophisticated that they can pass the enhanced reader. - Or the bad guys buy the cards locally and then use some of the debit amount and then bring the cards to their factory to re-fill and re-use it at the local store again and again. The card companies have installed countermeasures in selected stores to the cloning of the card by checking the serial number of the card and stopped the operation of the whole game machines in the store if a card with the serial number of the previously used (finished?) card is ever inserted into the game machine. Another simple method of fooling the reader was also reported about a month ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the most expensive card after 10,000 yen and 5,000 yen card are gone) and rotates the strip to invert its direction and then reassembles the card again using cement or something. To my surprise, it was reported to be deemed valid by some readers (!?). Apparently some readers only check for the position of the hole on fixed position and fooled to believe the card is valid if the hole is not in the expected position, etc.. Once not so rigorous readers are distributed, it is very difficult to upgrade all of them in Japan, I guess. The problem is complicated in that the counterfeiting only damages the card company. The parlors report the amount of debit money used in their shops and then compensated for the amount (less the small surcharge by the card company.) This means that every time the counterfeit card is used the card company alone loses money and the local parlor doesn't lose. There have already been reports of the owners of the pachinko parlors involved in the usage of the counterfeit cards. These bad owners allowed the bad guys to use the counterfeit cards in their parlors and pass the used debit amount to the card company and getting compensated. In these cases, the bad guys bring back the money (by simply exchanging the phony debit money into the steel balls, and then without playing (they can play if they wish), exchange the steel balls to the special gifts, and then exchange the gifts with money. [Usually, buying the steel balls and then exchanging them with gifts, and subsequently with money leaves you less money than you started with. The house always wins. In this case, the bad guys started out with counterfeit debit money and ends up with real money, so it is OK for the bad guys.] The parlor also gets the money for the used debit money. So they win, too. Only the card companies lose. Counterfeiting probably has existed since the first money (or equivalent) was ever invented. But, it surprised me that NTT Data approached the whole scheme so naively, especially since there have been reports of telephone card counterfeiting in Japan before. Some of the counterfeiting methods reported seemed so simple, and I have a doubt whether NTT Data was serious enough to deter counterfeiting. At least, I can safely say they have underestimated the ingenuity of the counterfeiters badly and didn't learn from the counterfeiting of telephone cards very well. Ishikawa, Chiaki (family name, given name) Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa(a)personal-media.co.jp ------------------------------ ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

RE: [Off-Topic] "Curfews"
by blanc 17 Dec '03

17 Dec '03

From: Timothy C. May Most of the ordinances, including the one here, specifically state that "blanket permission" by parents is not acceptable. They want _specific_ reasons for being out after curfew. ................................................................................... (sigh) Once again, the individual is backed up against the wall and made to answer to the State ("specifically") for their behavior in the world of human action. ("so who are you that I must explain myself to you?") I was considering the inclination of the list membership to focus upon technological, rather than political, solutions to certain social problems. Would a focus upon the idea of individual self-ownership & authority have any effect upon the State? (who *are* those people, anyway) The State resorts to the use of forcible methods in order to keep their non-valuable citizens in line. The citizens who feel themselves unfairly included resort to the use of technology to deal with impositions of the State upon them when their own ideas on morality are not accepted as legitimate. A lot of people talk about morality and justice, but really who gives a flip. The place of these ideas in the everyday life of each person reduces to irrelevance in the face of all the ignorance and cynicism, and in consideration of the alternative technologies which can be used in place of reasoning, when reasoning makes no difference (when you can't force people to think, as often happens). "I think it's time we re-evaluate the nature of our relationship". .. Blanc

1 0

RISKS: Pachinko card counterfeiting update
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Tue, 28 May 1996 22:09:28 +0900 (JST) From: Chiaki Ishikawa <ishikawa(a)personal-media.co.jp> Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15) I would like to add some background as someone who has played in pachinko parlors in Japan. (The origin of the game of pachinko is rather vague. Some say it is based on the ball game popular after the WW-II in U.S.A.. Anyway, it is a gambling business.) The card in question acts as a kind of debit card inside the pachinko parlors. It was introduced a few years ago by an former police official, with the expressed intention of keeping the money flow easy to track. (I would say it was a ruse to make a few companies where the ex-police officials can find jobs after retirement from the office. But I digress.) The cards are sold to the pachinko parlors and the customers buy the cards from the parlors, and obtain steel balls to play the game by inserting the card into the slot next to the game machine. Pachinko gambling works as follows. When you win the game, the number of steel balls in your possession increases and the customer can exchange the balls with gifts. (Therein lies a complication. Japanese law prohibits gambling, and so exchanging the steel balls with real money is illegal. *However*, first exchanging the balls with gifts, and then exchanging the gifts with money at a third party outlet [which is quite likely to be operated by the parlor owner] has been allowed by the police.) Speaking of loophole! Some people do bring back the gifts to homes: depending on the places, parlors carry game-boy cartridges, latest bestseller books, snack food such as cookies, instant noodles, umbrella, purse, movie video tape, music CD, to name a few as gifts. But if the customer wants to exchange his/her win indirectly to money at the outlet, then he/she has to ask for special gifts used essentially as money tokens by these establishments. These are often a tiny gold/silver foil embedded in thin plastic slab, etc.. Each parlor/outlet pair uses different stuff. In my hometown, a special brand of silk stocking was used as money token. This whole thing is a farce in view of the anti-gambling law in Japan.) Back to the card: the cards in question are used by two leading card manufacturers. (There are another couple of late-entry companies whose cards are not known to be attacked yet.) The card is based on the design done by NTT Data. NTT is the Japanese equivalent of old Ma Bell in the USA. NTT Data is a company that specializes in computer software integration, communication and such. I believe it designs the telephone card (debit card used for pay-phone in Japan), too. The pachinko card is the size of name card and plastic. The details are not published. To the best of my knowledge, I think there is a magnetic strip that contains the card ID information such as its serial number and the amount of debit money. There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards. (I said "were" because 10,000 yen and 5,000 yen cards are no longer available.) Attack method: >From what I saw and read, the first card verification mechanism used by the pachinko game machine was so primitive to defy rational explanation: each time the card was used, a tiny hole was punched to indicate the amount left in the card. As the customer uses the card, the position of the punched hole on card shifts toward the zero position. Once there is a hole on the zero position, the card is no longer usable. The first simple attack as far as I can tell was to fill in the hole in the card with tiny plastic (essentially the chaff produced when the hole is punched was used to fill in the hole). I am not sure if such simple attack was possible, but it seemed possible really at the beginning with crude modification of the magnetic data. Then, of course, the magnetic information on the card was also modified in more sophisticated ways when the card was used. However, the bad people also learned and somebody stole the reader mechanism and figure out the part of the magnetically-coded information: the result was that bad people could buy the pristine 10,000 yen card and then uses up to 2500 yen of the debit amount legally and then "re-fill" the card to 9500 yen worth, thus gaining 2000 yen for free again and again. (Until 3000 yen was used from the 10,000 yen card, the physical hole was not produced on the card, and only the magnetic information was changed. Hence the mere counterfeiting of the magnetic information was necessary to "revive" the card. No physical re-filling of the card was necessary. Physically re-filling the hole is easy to spot visually and was avoided by the bad guys.) [I have to confess that the exact amount involved in the counterfeiting is a little uncertain. But the general idea still holds.] Similar attack was possible with 5,000 yen card. Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was small compared with the risk, the bad guys didn't attack these cards until lately. Now the situation is that of cats and mouse. New counterfeiting methods and counter-measures follow each other in rapid succession. I believe that the cloning of the card was also done. But I don't know the details. Now, the card companies and pachinko parlors stopped issuing 10,000 yen and 5,000 yen cards because the damage was so large. Also, they have installed special readers to verify the validity of the card by incorporating more vigourous checking not available on the readers next to the game machine: it used to be that the cards sold could by used by any pachinko parlors in Japan. Now cards sold elsewhere have to be verified with this machine before used at a local game parlor. Cards sold at the local parlor can be used without such checking. Already, there are reports of counterfeit-card usage: - either the cards are so sophisticated that they can pass the enhanced reader. - Or the bad guys buy the cards locally and then use some of the debit amount and then bring the cards to their factory to re-fill and re-use it at the local store again and again. The card companies have installed countermeasures in selected stores to the cloning of the card by checking the serial number of the card and stopped the operation of the whole game machines in the store if a card with the serial number of the previously used (finished?) card is ever inserted into the game machine. Another simple method of fooling the reader was also reported about a month ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the most expensive card after 10,000 yen and 5,000 yen card are gone) and rotates the strip to invert its direction and then reassembles the card again using cement or something. To my surprise, it was reported to be deemed valid by some readers (!?). Apparently some readers only check for the position of the hole on fixed position and fooled to believe the card is valid if the hole is not in the expected position, etc.. Once not so rigorous readers are distributed, it is very difficult to upgrade all of them in Japan, I guess. The problem is complicated in that the counterfeiting only damages the card company. The parlors report the amount of debit money used in their shops and then compensated for the amount (less the small surcharge by the card company.) This means that every time the counterfeit card is used the card company alone loses money and the local parlor doesn't lose. There have already been reports of the owners of the pachinko parlors involved in the usage of the counterfeit cards. These bad owners allowed the bad guys to use the counterfeit cards in their parlors and pass the used debit amount to the card company and getting compensated. In these cases, the bad guys bring back the money (by simply exchanging the phony debit money into the steel balls, and then without playing (they can play if they wish), exchange the steel balls to the special gifts, and then exchange the gifts with money. [Usually, buying the steel balls and then exchanging them with gifts, and subsequently with money leaves you less money than you started with. The house always wins. In this case, the bad guys started out with counterfeit debit money and ends up with real money, so it is OK for the bad guys.] The parlor also gets the money for the used debit money. So they win, too. Only the card companies lose. Counterfeiting probably has existed since the first money (or equivalent) was ever invented. But, it surprised me that NTT Data approached the whole scheme so naively, especially since there have been reports of telephone card counterfeiting in Japan before. Some of the counterfeiting methods reported seemed so simple, and I have a doubt whether NTT Data was serious enough to deter counterfeiting. At least, I can safely say they have underestimated the ingenuity of the counterfeiters badly and didn't learn from the counterfeiting of telephone cards very well. Ishikawa, Chiaki (family name, given name) Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa(a)personal-media.co.jp ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

Class III InfoWar
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

Feel Free To Distribute Widely: Class III Information Warfare: Has It Begun? The June 2, 1996 Sunday Times from London front page headline reads: "City Surrenders to L400 million Gangs" And HERF Guns, Electromagnetic Pulses and sophisticated logic bombs may be responsible. At InfoWarCon II, Montreal Canada, I made reference to investigations I was conducting regarding concerted and organized attacks on up to 43 financial institutions in Europe and the US; an example of Class III Information Warfare. This issue of London Sunday Times brings a glimpse of the story that will eventually be told. The first attack in my files dates to January 6, 1993. A trading house in London was blackmailed into paying L10million to unknown extortionists who demonstrated they could crash the company's computers at will. The next incident in the Times article is also in my files: January 14, 1993 where similar demonstrations and demands were made for this time L12.5Million. And so is the next, January 29, 1993 and another L10Million siphoned off by the bad guys. According to my figures and those in the Times article, hundreds of millions of pounds have been paid ransom in what is clearly an example of Class III Information Warfare. According to officials in Washington, Whitehall, London, City of London Police, the National Security Agency, Kroll Associates, Bank of England and others (in the article) the threats are credible. The attackers have the clear ability to bring trading and financial operations to a halt - exactly when they say they will. "Banks, brokerage firms and investment houses in America have also secretly paid ransom to prevent costly computer meltdowns and a collapse in the confidence among their customers," sources said in the article. The article discussed the advanced information warfare techniques used by the perpetrators. "According to the American National Security Agency (NSA), they have penetrated computer systems using 'logic bombs' (coded devices that can be remotely detonated), electromagnetic pulses and 'high emission radio frequency guns' which blow a devastating electronic 'wind' through the computer systems." [For a complete description of HERF Guns (coined by Schwartau in 1990), see "Information Warfare: Chaos on the Electronic Superhighway," Thunders Mouth Press, 1994] The perpetrators have also left encrypted messages, apparently bypassing the highest security levels of the systems, leaving messages such as "Now do you believe we can destroy your computers?" The NSA and other officials believe that four gangs are involved; probably one from the US and probably one from Russia. But, because the crimes are international, national borders still prevail, making investigation more difficult. Investigations and official inquiries have been in progress for some time according to the article. Now, for a few things you will not see in the articlem, but will hopefully [if I am lucky] come out in the near future. The number of attacks is way above 40. They have been known about for almost three years, but only recently have people been willing to come out of the closet and discuss this highly sensitive issue with the media. Long briefs and analyses of these events have been submitted to high level officials and select business persons for at least a year, but to no avail. [Security by obscurity reigns all too often.] Banking is not the only industry that has been attacked and the attacks have been spread around Europe as well as Australia. As an industry many of us have said that the only way something will really be done is if we experience a Computer Chernobyl [Peter Neumann Phrase as I recall] or as I first said in Congressional Testimony, An Electronic Pearl Harbor. Are these events the harbinger of strong reaction by the community at large? As events unfold and more information is permitted to be disseminated over the next few days and weeks, we will see. We have essentially solved the issues of confidentiality and integrity. But, I have maintained that the real problem is going to be Denial of Service. These events are unfortunate, but clear examples of that reality. A Bank of England official also said of the incidents, "it is not the biggest issue in the banking market." Hmmm. I have to think about that. Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

2 1

I told you so
by Perry E. Metzger 17 Dec '03

17 Dec '03

Reposted from the firewalls mailing list. Date: Thu, 30 May 1996 16:39:33 -0700 From: Bill Stout <bill.stout(a)hidata.com> Subject: DES-3 Story retraction I retract the following story, it was told to me by a contractor who attended a MBONE group meeting on the MBONE, where the story originated: Story: 'A person working on the MBONE project did an unannounced experiment across the internet using Triple-DES for MBONE, and the very next day, 'ATF' agents knocked on his door and warned him against exporting munitions. The experimentor was shaken by the fact that agents approached him so quickly after the experiment.' The MBONE experimentor referred to in the story was Van Jacobson at the Lawrence Berkeley Labs. I followed this up since receiving much interested mail responses. I called Van Jacobson himself at the Lab (the web is a wonderful thing!), and found that the story was embellished. The real event as told by Van Jacobson was: 'MBONE software was at one time accidentally compiled with links into libraries which contained DES, and someone (I don't remember who) noticed the DES capability in our MBONE binaries, and informed the group about the encryption export problem. The problem was promptly fixed.' Sorry for the mis-information. Bill <=======10========20====Ruler for Eudora users==50========60========70========80 William B. Stout | "Stop socialism in America!" Senior Systems Admin | "Dilbert for President." Hitachi Data Systems | "Police power today=police state tomorrow." Open Systems Center | "The secret of life - being part of the process of Santa Clara, California | creation." 408-970-4822 | #include <sanity_disclaimer.h> <=======10========20========30========40========50========60========70========80

2 3

Re: WSJ on "IRS-bashing"
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 04:01 PM 5/29/96 -0700, Rich Graves, who lives in a parallel universe where political correctness is no threat to liberty, and the FBI and BATF no threat to law abiding people wrote: > any such law > would be invalidated by R.A.V. v. St. Paul. The only exceptions are > restrictions on "fighting words" that meet the tests in Chaplinsky v. New > Hampshire and "hostile working environment" discrimination, which I assume > is what you're talking about, in some elliptical way. When I was looking for a house in Oregon, I pointed at the map and asked the real estate lady "Why are houses in this area cheap". She did not give a straight answer I pressed her, and then she then started asking me questions that indicated she suspected I was an agent provocateur from the government trying to entrap her into revealing forbidden information. I eventually discovered that the area in question was occupied predominantly by people of a particular ethnic group, but she was forbidden to tell me this information. This explanation of the price disparity did not occur to me until she started feeling me out to see if I was a cop. But Rich Graves does not regard that sort of thing as any violation on freedom of speech. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Remailer chain length?
by Jim Choate 17 Dec '03

17 Dec '03

Hi Scott, Forwarded message: > Subject: Re: Remailer chain length? > Date: Fri, 31 May 1996 14:55:58 -0500 > From: Scott Brickner <sjb(a)universe.digex.net> > > >If this is strictly true, why not simply run several instances of a remailer > >on the same machine. Then randomly chain them prior to sending them off > >site. This would be a lot cheaper and faster than trying to convince > >hobbyist to set it up or businesses to to use their profit & legal council. > > Because it's not strictly true. Implicit in traffic analysis is looking > at the "envelopes" of the traffic. Since this means intercepting those > envelopes, once you've put your monitor on the first remailer at a site, > you've probably gotten all the rest at the site for free. > > I don't think multiple remailers at the same site help anything. > I agree completely. If traffic analysis is going to be done on a single box it isn't going to matter how many remailers are there. The monitor will simply grab them all. At this point it simply maps them thusly: incoming message > remailer #1 > .... > remailer #n > outgoing That this really maps to is obvious: incoming message > remailer #1-#n > outgoing The only thing this does is increase the number of valid entries in the From: field. Succesful traffic analysis does not require that the From: field contain only a single item. As a matter of fact it makes no difference what the headers contain unless the body is put in some kind of envelope for final delivery. Why? Because all one has to do is look at the body of the text which will not have changed. This leads to a simple model, based on a physical remailer: 1. Physical remailer receives an evelope addressed to them. 2. They open it and find a $1 money order (for paying the remailer) and another envelope with another delivery address on it. 3. Remailer puts $1 in bank and the interior letter in the mail. To convert this to electronic means: 1. Remailer receives a email that is encrypted except for the header. 2. Remailer decrypts mail (ie removes the outer envelope) and find three items, block of encrypted data (ie inner envelope) with header to next site and e$ token for $1. 3. Remailer sends the data on its way. There are a couple of points to be made. 1. No traffic is handled in the clear except for the header to the current destination all others are nested in encryption. 2. Remailer chaining is handled entirely by the customer (ie customer addresses the envelopes) 3. $1 is the smallest amount normaly accepted as a fee for a valid contract. 4. Remailer can't look at data because there is no way to find the correct sequence of keys to unlock the nested encryption. 5. Automaticaly limits spamming unless a remailer allows cloning AND all recipients share a commen private key. 6. It maps 1:1 onto the physical remailer model with the same limits on information at each stage. This allows one to directly apply the current history of precedence involving anonymity and physical remailers. Under todays current legal and social structure this is the only model that will prevent remailers from being held accountable for their traffic and at the same time provide enough income to keep legal protection at hand. Note that I am not saying you still can't be brought brought up on charges, simply that you (as a remailer) now have the structure in place to fight it succesfuly. This is the basic model that the Austin Cypherpunks are working on at the currrent time. The big problem we have right now is determining if the body is actualy encrypted. We have done some basic tests of encryption-spoofing using pgp and it is looks to be a thorny problem. It simply is not trivial to look at a block of characters and determine if they are actualy encrypted. You can't rely on the wrapper around the data put there by the encryption program because this can be kept intact and the data changed. As long as the checksum matches it all looks the same. Even if the test is done with a dictionary this won't help because rsa does not guarantee that once the data is encrypted that the output would be gibberish, sort of like the "All the monkeys in the world typing create Shakespeare" story. It is completely feasible (though unlikely) for the encrypted text to be something meaningful in some language or another. Jim Choate

2 1

URL for NRC Report
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Instructions for Web access to the NRC report, "Cryptography's Role in Securing the Information Society," May 30, 1996, Prepublication Copy, are at: http://pwp.usa.pipeline.com/~jya/nrc.txt Appendices A to N are now in individual files. A few typos have been corrected in nrc00.txt and nrc06.txt. For the coder, mathematician and avid proofreader, we'll JPEG and forward any page that contains equations -- such as those in Appendix C.

1 0

Re: whitehouse web incident, viva la web revolution
by Hallam-Baker 17 Dec '03

17 Dec '03

Vladimir Z. Nuri wrote: <Uninformed crap> Its worth pointing out that a complaint to an editor is not necessarily pressure. Did the Whitehouse threaten to sue HotWired? What _pressure_ was applied? I find Meeks' style somewhat tiresome. It is tabloid jornalism rather than reasoned argument. His dislike for the Clinton is well known - he recently accused the administration of being fascist. I know of no evidence that the Clinton administration has a genocide policy, it is an insult to the 10 million civilians murdered by Hitler to use the term facist simply as a term of abuse, especialy if it is being used as a substitute for an argument. Point of fact: the skeleton closet does not know how traded options work. If one sells a traded option one is liable to pay the broker if the market moves the opposite way to that hoped for. Normally the broker asks a client to put up a deposit or "margin" to ensure that the broker can recoup the money. In this case the broker knew that Hilary had good credit and so accepted only a token deposit as "margin". Had the market moved in the opposite direction Hillary would have been liable for very much more than $1000, she was liable for hundreds of thousands. In most cases it is profitable to sell options, it is only if the market moves in the "wrong" direction that one can lose out. In such cases the losses are unlimited - the potential profit being fixed. This is why most punters buy options - the potential loss is limited. You can see a similar effect in the market each time there is a "short squeeze". A lot of people bet on Netscape going down in price because it was overvalued. The number of short positions turned out to be higher than the number of shares on offer which meant that many people were having to buy shares at high prices to cover their positions. This is how lack of confidence in a stock can send it through the roof. The free market - don't you just love it? Phill

6 10