December 2003 - cypherpunks-legacy

Re: really undetectable crypto
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 12 Sep 96 19:26:56 -0700, Jim Miller wrote: >Most everybody on the list is familiar with the technique of hiding >encrypted messages in the LSBs of image files. Personally, I would not >use such a technique because don't I believe it's really undetectable. I >assume, without proof, that the LSBs of images files have statistical >properties that are sufficiently different from encrypted data that a >clever person could determine whether or not an image file contained an >imbedded encrypted message. Actually, if you use only a few bits - and not, say, bit 15 of *every* pixel - you can feel secure *IF* you are writing truly encrypted data. A regular PGP message has a bunch of header material that most certainly is not random-looking. OTOH, if you only write the raw data, then there is no way to differentiate from the random noise added by any scanner - in most cases, the last couple bits in each RGB triplet of a truecolor image are random. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

DIMACS Trust management workshop, Sept 30 - Oct 2.
by Matt Blaze 17 Dec '03

17 Dec '03

------- Forwarded Message Received: from amontillado.research.att.com (amontillado.research.att.com [135.205.42.32]) by nsa.research.att.com (8.7.3/8.7.3) with ESMTP id LAA24206 for <mab-local(a)nsa.research.att.com>; Tue, 17 Sep 1996 11:52:51 -0400 (EDT) Received: from research.research.att.com (research.research.att.com [135.205.32.20]) by amontillado.research.att.com (8.7.5/8.7) with SMTP id LAA14378 for <mab(a)issr.research.att.com>; Tue, 17 Sep 1996 11:52:30 -0400 (EDT) Received: from ns.research.att.com by research; Tue Sep 17 11:48:17 EDT 1996 Received: from henson.rutgers.edu by ns; Tue Sep 17 11:06:01 EDT 1996 Received: (from bquigley@localhost) by henson.rutgers.edu (8.6.12+bestmx+oldruq+newsunq+grosshack/8.6.12) id LAA26298; Tue, 17 Sep 1996 11:02:41 -0400 Date: Tue, 17 Sep 1996 11:02:41 -0400 From: Barbara Quigley <bquigley(a)dimacs.rutgers.edu> Message-Id: <199609171502.LAA26298(a)henson.rutgers.edu> To: dimacs-members(a)dimacs.rutgers.edu, local-list(a)dimacs.rutgers.edu, dimacs-dimacs(a)dimacs.rutgers.edu, dimacs-current-postdocs-industry(a)dimacs.rutgers.edu, dimacs-current-postdocs-univ(a)dimacs.rutgers.edu, dimacs-current-visitors(a)dimacs.rutgers.edu, rutgers-list(a)dimacs.rutgers.edu, theorynt(a)vm1.nodak.edu, finite-model-theory(a)informatik.rwth-aachen.de Subject: DIMACS Workshop on Trust Management in Networks, Rutgers University, September 30 - October 2, 1996 DIMACS Workshop on Trust Management in Networks September 30 - October 2, 1996 DIMACS, Rutgers University - ---------------------------------------------------------------------------- Organizers: Ernie Brickell brickell(a)btec.com Joan Feigenbaum jf(a)research.att.com David Maher dpm(a)allegra.att.com Theme: The use of public-key cryptography on a mass-market scale requires sophisticated mechanisms for managing trust. For example, any application that receives a signed request for action is forced to answer the central question ``Is the key used to sign this request authorized to take this action?'' In certain applications, this question reduces to ``Does this key belong to this person?'' In others, the authorization question is considerably more complicated, and resolving it requires techniques for formulating security policies and security credentials, determining whether particular sets of credentials satisfy the relevant policies, and deferring trust to third parties. This workshop covers all aspects of the trust management problem. Relevant topics include but are not limited to: * General approaches to trust management * Languages, systems, and tools * Certificates and public-key infrastructure * Formal models and analysis * Trust management in specific application domains; including but not limited to: o Banking o E-mail o Internet commerce o Licensing o Medical information systems o Mobile programs and ``code signing'' o Revocation of cryptographic keys For more information: Information about local arrangements, travel, lodging and registration can be found at http://dimacs.rutgers.edu/Workshops/Management. Those without WWW access can contact Pat Pravato at 908-445-5929 or pravato(a)dimacs.rutgers.edu. This workshop is part of DIMACS Special Year on Networks. Information about the Special Year on Networks can be found at DIMACS WWW site: http://dimacs.rutgers.edu or by contacting the center. __________________ Program: Monday, September 30, 1996 8:15 Continental breakfast 9:00 Welcome to DIMACS Fred Roberts, DIMACS Director 9:15 What is "Trust Management," and what are the Workshop Goals? Joan Feigenbaum, AT&T Laboratories 9:45 Let a Thousand (Ten Thousand?) CAs Reign Stephen Kent, BBN Corporation 10:45 Break 11:00 The PolicyMaker Approach to Trust Management Matt Blaze, AT&T Laboratories (Joint work with J. Feigenbaum and J. Lacy) 12:00 Lunch 1:15 SDSI: A Simple Distributed Security Infrastructure Butler Lampson, Microsoft (Joint work with R. Rivest) 2:15 SPKI Certificates Carl Ellison, Cybercash 3:15 Break 3:45 Panel Discussion Moderator: David Maher, AT&T Laboratories Panelists: Blaze, Ellison, Kent, and Lampson 5:30 Wine and cheese Tuesday, October 1, 1996 8:15 Continental Breakfast 9:00 Using PICS Labels for Trust Management Rohit Khare, World Wide Web Consortium 9:30 Managing Trust in an Information-Labeling System Martin Strauss, Iowa State University (Joint work with M. Blaze, J. Feigenbaum, and P. Resnick) 10:00 Trust Management in Web Browsers, Present and Future Ed Felten, Princeton University (Joint work with D. Dean and D. Wallach) 10:30 Break 10:45 IBM Cryptolopes, SuperDistribution, and Digital Rights Management Marc A. Kaplan, IBM Watson Research Center 11:15 Requirements and Approaches for Electronic Licenses David Maher, AT&T Laboratories 11:45 PathServer Michael Reiter, AT&T Laboratories (Joint work with S. Stubblebine) 12:15 Lunch 1:30 Inferno Security David Presotto, Bell Labs -- Lucent Technologies 2:00 Transparent Internet E-mail Security Raph Levien, University of Calfornia at Berkeley (Joint work with L. McCarthy and M. Blaze) 2:30 Secure Digital Names Stuart Haber, Bellcore (Joint work with S. Stornetta) 3:00 Break 3:30 Untrusted Third Parties: Key Management for the Prudent Mark Lomas, Cambridge University (Joint work with B. Crispo) 4:00 Distributed Trust Management using Databases Trevor Jim, University of Pennsylvania (Joint work with C. Gunter) 4:30 Distributed Commerce Transactions: Structuring Multi-Party Exchanges into Pair-wise Exchanges Steven Ketchpel, Stanford University (Joint work with H. Garcia-Molina) Wednesday, October 2, 1996 8:15 Continental Breakfast 9:00 Policy-Controlled Cryptographic Key Release David McGrew, Trusted Information Systems, Inc. (Joint work with D. Branstad) 9:45 An X.509v3-based Public-Key Infrastructure for the Federal Government William Burr, Nat'l. Inst. of Standards and Technology 10:15 Break 10:30 The ICE-TEL Public-Key Infrastructure and Trust Model David Chadwick, Salford University 11:00 A Distributed Trust Model Alfarez Abdul-Rahman, University College, London (Joint work with S. Hailes) 11:30 On Multiple Statements from Trust Sources Raphael Yahalom, Hebrew University and MIT 12:00 Lunch 1:00 Off-line Delegation in a Distributed File Repository Arne Helme, University of Twente (Joint work with T. Stabell-Kul) 1:30 Operational Tradeoffs of Aggregating Attributes in Digital Certificates Ian Simpson, Carnegie Mellon University 2:00 Trust Management for Mobile Agents Vipin Swarup, Mitre (Joint work with W. Farmer and J. Guttman) 2:30 Break 3:00 Trust Management in ERLink Samuel Schaen, Mitre 3:30 Linking Trust with Network Reliability Y. Desmedt, University of Wisconsin at Milwaukee (Joint work with M. Burmester) 4:00 Trust Management Under Law-Governed Interaction Naftaly Minsky, Rutgers University (Joint work with V. Ungureanu) 4:30 Tools for Security Policy Definition and Implementation Polar Humenn, Blackwatch Technology, Inc. ------- End of Forwarded Message

1 0

Re: (fwd) Email Robot draws fire from CypherPunkz
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 13 Sep 1996 09:02:19 -0700 (PDT), Declan McCullagh wrote: >The Cypherpunks gang has apparently attacked a San Francisco artist's ^^^^ No wonder the Feds want to close us down. Look at all the dangerous things we've done this week: 1. Shot the bull 2. (see #1) 3. (see #1) et cetra # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: J'accuse!: Whitehouse and NSA vs. Panix and VTW
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 13 Sep 1996 11:33:09 -0700, stewarts(a)ix.netcom.com wrote: >Anybody for an Internet Driver's License? *Surfer's* license. The newsies love to refer to "net surfing", because to the highly unknowledgable reader it makes it sound as if they have a clue about what they're writing on. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: Fed appellate judge remarks re anonymity, free speech on the net
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 13 Sep 1996 07:47:27 -0700 (PDT), Z.B. wrote: >> At 09:24 PM 9/12/96 -0700, zachb(a)netcom.com wrote: >> >> (Also in today's news, the 9th Circuit upheld a CA statute forbidding sales >> >> of material considered "harmful to minors" from vending machines.) >> > >> >Even if this statute is meant only to apply to cigarette machines, which >> >would seem to be the case given all of the anti-cig stuff going on now, >> >what good will it do? >> >> Whoops. Sorry. Wrong context. What I should have said was "the 9th Circuit >> upheld a CA statute forbidding sales of *printed* material considered >> 'harmful to minors' from unsupervised vending machines". The publication(s) >It's still mostly the same thing. I've never seen the type of machine >that you're talking about, and I don't think anyone would be dumb enough >to install one in a store that is near a school, or frequented my >minors. This law just does not seem like a very good idea. Where did you live? I used to walk home from school (in Ventura, CA - about 1 hour away from LA) and see a vending machine selling copies of "LA X-Press" (Or something like that) right next to the vending machines for the Star-Free Press and the LA Times. This was on the curb by a busy shopping center, on the block opposite of the County of Ventura's government center. Hypothetically, it was even plausibly deniable (the watchword of the Clintons) - "I was just buying this copy of the newspaper." And before someone asks, no, I wasn't buying them. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: Workers Paradise. /Political rant.
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 14 Sep 1996 21:08:58 +0200 (METDST), Asgaard wrote: >>The 70% already _are_ cutting the throats of the other 30%. It's called a >>60%+ tax rate. This is the sum of: federal income tax, state income tax, >Most of these taxes are not used for feeding the poor but to support >the Nomenclatura of the Bureaucracy and we all want to get rid of that. Quite true; I'd love to see the government run as a business, where some departments might run out of money 6 months early if they aren't careful. It'd be hard at first, but they'd have to change to survive... >standalone women to make babies to get benefits was very bad. The >Chinese system - less benefits the more children you have - is the >way to go. ++agree (Orwell also contributed other conventions. . .) >>(The point being that people want more than "basic food and shelter," but >>are often unwilling to make the commitments and sacrifices in their lives >>to gain the wherewithal to earn significant salaries.) >This is where we disagree. The real lazy ones are satisfied with a roof >over there heads, a microwave oven for cooking pizza, a six-pack and >a soap opera. Most people really do want to achieve something more in >their lives. How many of them are willing to go pick grapes for below minimum wage, since they've carefully avoided learning anything remotely useful? We have a ton of illegal immigrants who are quite willing to do so. The market is there, so why aren't they working? >>There is a basic error here, one that I see often. Who says that the >>"anarcho-capitalists" will freely give away, say, some vast fraction of >>their profits so as to subsidize the overall society? Any more so than the >Not a vast portion, if the above_basics capitalistic economy blooms. >Probably 10% would suffice - what was once paid to the church, the >institution that traditionally has supported the ill and poor. traditionally *raped* the ill and poor. Nothing wrong with true charity, but do you really think all the gold and art that (for instance) the Vatican acquired, much of it during the dark ages, was from giving contributions to the poor? Most of the time, they were the problem: "Give us money to buy absolution or your loved ones will rot in Hell forever!" # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: Erasing Disks
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 14 Sep 1996 20:11:45 -0500 (CDT), Douglas R. Floyd wrote: >> >But shredding the floppy? No need to classify that, no secrets leaked >> Burn after shredding, or you have a puzzle fan reassembling the shredded disk. >Actually, taking the cookie portion out, putting it on an inverted cup so >its in the center of the microwave, then letting it cook for 30 seconds >does the job quite well =) I've always been a fan of applying lighter fluid in a fashion similar to the way the allies applied napalm to Dresden. It's more satisfying... <g> # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: SPL -- Suspicious Persons List
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 14 Sep 96 17:36:49 EDT, Dr.Dimitri Vulis KOTM wrote: >> unjust if the company was bought out and the new owner decided to sack >> all black people and people called "Perry". You were the one who brought >> up the issue of fairness. >The owner should be able to do that without interference from any gubment. Yes. If they manage to survive economically while snubbing a productive chunk of the general population in addition to a loon, good for them. If their product still sells, inspite of negative publicity it's probably the market leader. OTOH, I think there should be some basic safeguards against the formation of 'company towns' or similar constructs. A free market is rarely a given. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Dealing with junk mail
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## 09/17/96 09:26 am ## Subject: Dealing with junk mail ] There has been a bunch of stuff in the news lately about junk e-mail, including the recent judge's ruling that AOL must allow known junk-mail through to its subscribers while the judge hears arguments from AOL and the junk-mailers. I'm a little divided on the whole issue of whether or not it's wise policy for ISPs to, in general, refuse to deliver suspected junk mail. The obvious problem is that it puts ISPs in the position of deciding whether or not some piece of e-mail is worthwhile. (To clarify, I certainly *don't* think that ISPs should be prohibited by law from blocking delivery of or access to anything they choose to--there are plenty of ISPs to choose from, and users can move if they don't like their current ISPs' policies. I just don't think I'd like Delphi to start filtering my e-mail without asking me for permission and instructions first.) I've been thinking about an alternative approach to blocking commercial spam. It has some potential technical problems, but I think it could be made into a workable 95% or so filter. Many people are already filtering messages locally, and now some providers are getting into the act, as well. Unfortunately, because of the economics of junk e-mail, I think that this, by itself, will probably lead to people refusing to accept almost all e-mail from people they don't know. This is a really bad outcome. What I'm proposing is an extension to this, in which many peoples' filters coordinate their actions to detect and block spam. Each user has a mail filter with a set of rules written either by or for that user. The mail filter does one of four things with each piece of e-mail it receives: a. It lets the e-mail through immediately. (E-mail from friends, employers, employees, family members, etc. would probably be in this category.) b. It discards the e-mail immediately. (E-mail from people you really didn't like, and from people who have spammed you in the past would probably be in this category.) c. It puts the e-mail on hold in some storage area. d. Send e-mail back to the sender, informing him of conditions under which the user is willing to accept this e-mail. This might be things like requiring anonymous users to provide some minimal kind of identity, or telling senders ``I'll read your e-mail for one dollar in digicash,'' or ``I'll read your e-mail if you carry out this computationally expensive calculation, or some other thing. For e-mail in the third category, some kind of summary report is sometimes generated, to be sent to a server. The server collects these reports, and uses some kind of system (maybe rule-based, but probably involving scores to estimate probability of spam or other unwanted e-mail) to determine what is and is not spam, and with what probability. It then sends to each of its subscribers, every day or so, a report indicating scores for users' messages. (These should be individualized.) The mail filters then do one of four things to each piece of mail rated, based on the scores: a. Pass the message through immediately. b. Discard the message immediately. c. Add the message to a list of low-priority messages, to be read when the user has some spare time. d. Send e-mail back to the sender, informing him of conditions under which the user is willing to accept this e-mail. This might be things like requiring anonymous users to provide some minimal kind of identity, or telling senders ``I'll read your e-mail for one dollar in digicash,'' or ``I'll read your e-mail if you carry out this computationally expensive calculation, or some other thing. The junk e-mailers can try various countermeasures to this. The most obvious are: a. Try to hit people who aren't using a good junk-mail filter. b. Try to make it against the law to use a junk-mail filter. (Perhaps this would be the case only for PSA spams?) c. Try to disguise their e-mail to make it not obviously junk e-mail, and simultaneously to alter each message to avoid detection by the servers, by making changes to each message, timestamp, and claimed sender ID. I think (c) will be somewhat difficult for the junk e-mailers, if the people who run the servers are reasonably clever. The servers should run indexes that find many identical or similar sentences, paragraphs, etc, in messages sent to many people. I think either the junk e-mailers would give up on these filters immediately, or there would be an endless arms race between advertisers and filter servers. There are some potential problems with this approach, though. The servers will be getting a lot of information about what e-mail is coming to each of their users. There will be serious privacy concerns, especially if the filters work after decrypting public-key encrypted messages. (Note that if the user's public key is reasonably long, PK encrypting the message will actually be pretty hard for thousands or millions of messages at a time. Also, there will be various denial-of-service attacks, where I know Alice is getting ready to send Bob some e-mail I don't want him to get, so I intercept Alice's e-mail and forward it to 10,000 other people--thus ensuring that it will be classified as spam. Comments? Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj7vzUHx57Ag8goBAQGUbgQAsP62f0HDO4L0cs3DjCh9ppX3IgQUX8l6 W4JtH3WPfaHrzftD4UMGZ3D41kCjvGht/s62dPtq4lzDbqSpSB81oh4RVuyEw/kD CZ4L0q2q6jFkTdnIp2mvP1WNlCTTpw2BBKY5U4tYCcthq8y30YmOGSqpKouK4l9S gCV3Nd6C/Ig= =Dent -----END PGP SIGNATURE-----

2 1

Wealth Tax vs. Capital Gains Tax Reduction
by tcmay＠got.net 17 Dec '03

17 Dec '03

I've been thinking a lot about the prospects of a "wealth tax," or "asset tax," in the U.S. With the stock market averages at record levels (and, hey, Intel has gone up $6 just so far today, to an unheard of $94.5 level), and with increasing fractions of people's overall net worth tied up in equities, bonds, houses, property, etc., it may be that the looters will take a more serious look at taxing people's overall wealth, e.g., the 5% of net worth per year that some countries have. (At the same time, there is also a chance that the tax on capital gains will be greatly reduced or even possibly eliminated, also as some countries such as Japan have already done.) The conundrum is this: so long as stocks, bonds, and other holdings are not taxable while unsold, and so long as large amounts of private pension funds and whatnot are flowing into equities, this wealth is "unreachable" to the government tax collectors. Further, much of this wealth is "locked" by the high marginal tax rates on capital gains (35-40%, depending on which state one lives in, on so-called "tax preference items," etc.) Many people will not sell assets if they have to pay 35-40% to the tax man if they sell, but nothing if they just sit on the asset and watch it go up in value. (Obviously, the assets get sold eventually. But many people will choose to simply not worry about the heavy taxes _this_ year, and delay selling 'til some future date. They may also think the capital gains rates will go down, or may have visions of taking their stock certificates and simply moving to Anguilla :-}.) If this trend continues--more money in equities and investments, and a higher overall valuation (as prices are driven up by more folks getting in, and by other conventional factors)--the government would seem to have two main choices: 1. Start taxing the overall wealth, e.g., 5% per year. 2. Reduce capital gains taxes so that the "locked assets" will at least come to market and generate some income from capital gains, even if at a reduced level. At 6:38 PM 9/17/96, Duncan Frissell wrote: >Note too the recent article in the Economist about how European firms are >raising capital in the UK and the US because it is available there in >private pension savings while European government retirement systems suck >loads of capital out of the system leaving nothing but massive government >debts. The flow of capital into equities is truly astounding. Some fraction of Americans are really preparing themselves well for retirement, emergencies, vacations, etc. Of course, a distressing fraction of Americans have no savings plans to speak of, and will essentially have no money as they age. Needless to say, I despise the idea of a "wealth tax," and I can see various loopholes and workarounds. I'd also expect a lot of folks to simply move out of the country if this were to happen. In the current political climate, I'd say the chance of a wealth tax in the next several years is small. Ditto for a capital gains tax rate reduction. As with selling assets, "doing nothing" is often the likeliest path. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4