December 2003 - cypherpunks-legacy

Dallas Semiconductor turns on Internet commerce at the touch of abutton
by Robert Hettinga 17 Dec '03

17 Dec '03

Dallas Semiconductor turns on Internet commerce at the touch of a button; wearable computer chip generates uncrackable codes using public key cryptography ---------------------------------------------------------------------- DALLAS--(BUSINESS WIRE)--Oct. 7, 1996--"Attention, cyber-shoppers! Your `electronic wallet' is almost ready." Internet users have been waiting for personal, trusted computing to conduct commercial transactions -- mere pennies or big bucks. Now it has been successfully demonstrated. Dallas Semiconductor (NYSE: DS) Monday announced development of the Cryptographic iButton, a very personal computer in a 16mm, stainless steel case that provides for the safe transfer of Internet e-mail -- including credit card numbers -- even if the client computer, software and communications links are not trustworthy. The Crypto iButton is the result of a multi-year development at Dallas Semiconductor to reach the pinnacle of computer security. "Think of it as a wearable, digital accessory," said Michael Bolan, vice president of marketing for the 12-year-old manufacturer that produces 120 million chips annually. "You can attach it to your wallet, keychain, jewelry (ring or bracelet), wrist watch, or badge. With the electronic wallet, the iButton communicates without the user even having to open the wallet, providing convenience and security. "This credential cannot be duplicated because it contains information that is never revealed. It positively authenticates a person to a server computer or to another person using two-factor security: personal possession of the iButton plus a PIN (Personal Identification Number)," Bolan explained. iButton users will have universal access to their World Wide Web e-mail at public Internet connections (hotels, airports, kiosks) and still be confident that their mail is kept private. Sensitive information like credit card numbers can be transmitted safely by secure e-mail using the Cryptographic iButton. Mobile employees -- so-called "road warriors" -- can improve their productivity with economical, secure access to corporate databases. iButton Overcomes PC Vulnerability When software and PC hardware are hacked, information remains safe in the physically secure iButton chip. In one service model, the iButton chip randomly generates a public and a private key set. The private key is known only to the Cryptographic iButton; it is never revealed, not even to its user. The large key size of 1024 bits (308 decimal digits) makes guessing insurmountable. The iButton ensures both parties are truly authorized to communicate by rendering messages into unbreakable digital codes using its high-speed math accelerator. The Crypto iButton addresses both components of secure communications: authentication and safe transmission. Physical attacks on the iButton by technologically savvy criminals are thwarted. The continuous steel perimeter triggers a tamper response upon intrusion. Critical security parameters, including the private keys, are rapidly erased. Vulnerabilities of Smart Cards to certain physical attacks, recently reported by computer scientists at Bellcore, were anticipated during the design of the Cryptographic iButton. Even if the iButton is subjected to extraordinary physical stresses, it does not leak out information that can be useful for inferring secret data. Included on the monolithic chip is a True Time Clock, a real-time clock with tamper evidence. It provides a trusted time stamp and audit trail for microcash metering or other off-line transactions, as well as aiding in the detection of fraud by putting time limits on service. When the clock reaches a pre-set time, the chip self-expires and requires reactivation before service can be renewed. Unlike a loose plastic card, the iButton stays attached even while communicating, making misplacement less likely. Messages or transactions are authorized only after the PIN is validated by the iButton, the same technique automatic teller machines use to dispense cash. Microcash Stimulates I-Commerce "We don't expect to make money obsolete, although our small cash version of the iButton is currently doing millions of transactions as an electronic coin purse for mass transit riders in Istanbul, Turkey and for patrons of Laniel vending machines in Canada," said Bolan. "One strength of the Crypto iButton," he continued, "is its ability to meter extremely small amounts economically in off-line distributed systems. A secure micro-payment system for electronic property will ultimately enrich the content on the Internet by giving producers a monetary incentive to distribute their work. "For example, reading the front page of a newspaper may tabulate only 1 cent worth of microcash in a subscription meter while downloading a Java software applet may tabulate a larger amount in a copyright meter. The multiple meters of the iButton count the usage information over the network for easy revenue collection by the service provider's clearinghouse," he said. One of the earliest anticipated uses will be by the U.S. Postal Service, which has already notified its postal meter customers that it will replace its current postage meters using a Postal Security Device (PSD) connected to a PC. Using the Cryptographic iButton as a PSD, the USPS will be able to refill its postage meters over the Internet. Implementation and Availability The iButton is touched to a Dot Receptor which can be fitted to any of the 200 million existing personal computers in a matter of minutes without opening the computer's enclosure. The Dot Receptor is cabled to the printer port, forming a $15 pipeline to the PC. In this way the iButton can be the physically secure co-processor to any PC. Dallas Semiconductor will activate Crypotographic iButtons issued to individuals or co-issued by service providers. The devices will be activated from the manufacturer's Web site. Dallas Semiconductor plans to begin delivering the Cryptographic iButton and Dot Receptor in the first quarter of 1997. The company projects that it can drive down the cost of using its Cryptographic iButton to $12 per year. The street price of the Dot Receptor is $15. Less sophisticated versions of the iButton are currently available. The simplest version, the DS1990, costs $1.59 in 1,000-piece quantities. For more information, visit the iButton Web site at www.iButton.com. Dallas Semiconductor (NYSE:DS) designs, manufactures and markets CMOS chips and chip-based subsystems. In its 12-year history, the company has sold its products to more than 8,000 customers worldwide. These include Original Equipment Manufacturers (OEMs) in instrumentation, factory automation, personal computers, office equipment, telecommunications, medical equipment, and mainframe computers. Chips and subsystems are sold through a direct sales force, software developers, distributors and manufacturers' representatives worldwide. ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Libel & Pseudonymous Reputation
by Stanton McCandlish 17 Dec '03

17 Dec '03

A new item at the EFF archives might be of interest: http://www.eff.org/pub/Legal/CyberLaw_Course/cyberlaw.038 - CYBERSPACE LAW FOR NON-LAWYERS: Topic: Libel 7: Injury to a Pseudonym's Reputation? -- <HTML><A HREF="http://www.eff.org/~mech"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org"> Electronic Frontier Foundation </A><P> Program Director </HTML>

1 0

Re: Statism/Theocracy What's the difference--LDS
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

So Snow, Should your parents be (have been) allowed to pass curfew laws along with the rest of the community so that their wishes about you not going out could be enforced? Ryan ---------- Previous Message ---------- To: attila cc: cypherpunks From: snow @ smoke.suba.com @ smtp Date: 10/06/96 01:11:58 AM Subject: Statism/Theocracy What's the difference--LDS Attila said: > In <v03007808ae7af10d0afb(a)[207.167.93.63]>, on 10/04/96 > at 09:03 AM, "Timothy C. May" <tcmay(a)got.net> said: > Frankly, we do not wish curfews, and there never were curfews > before the immense immigration into the area, mostly from So. CA, > However, these people, Mormons (some good, some inactive) and (inactive=bad?) > well, that prompted the curfew, but they found it also > maintained the semblance of peacful family oriented community > among the lost and alienated families --so it is apparently here > to stay. other than the fact we are telling tparents who do not > wish to manage their children they must keep them home or take them > somewhere, what does the law do? <snip> > >.Telling people when they > >.can be on public streets and when they cannot is no different than telling > >.them what they can read and what they cannot. > that was my initial reaction -you wouldn't tell me that! but > consider the right of society to legislate and regulate in the > common good, despite both my and your abhorence of law in an of > itself. GAK is for the "common good", after all, it is only the people who are doing wrong that will be hurt by having their data scanned by the Government, it is just maintaining decency standards. > > it is an effective means of forcing parents who do not seem to > care, or parents who wish to shift their responsibilities to social > workers who are not available, they have a responsibility. what > happens to the violators --few are arrested, they are asked to go > home. there is no great wild-west roundup of teenaged cattle! any > who resist or commit minor vandalism are taken to the center --but, For most of my life I have had insomnia, and when I was in my early to mid teens, I used to wait until my parents had gone to sleep, and go out and wander the neighborhood, Mostly alone, sometimes until 2 or 3 in the morning (during the summer, not when I had to be at school). Why _shouldn't_ I be allowed to do this? In my case, it was against my parents wishes, but I still harmed nothing, commited no crime (there was no curfew where I lived). My father almost caught me (he knew I did it from time to time, but figured as long as I wasn't causing trouble, he wouldn't be able to stop me). Just because other children cause trouble, why should _mine_ be restricted? Just because it gives the APPERANCE OF MORALITY? I'll say that again, THE APREARANCE OF MORALITY. Forcing someone to follow a given set of rules doesn't make that person moral, it makes them a slave. Morality only comes in when there is choice. Also, the waters are calm on the surface, but what about underneath? What is going on behind closed doors? Here in the outerworld, we have fornication on the streets, but we know who is doing it, we _know_ who the problems are. Do you? > unlike every other city I have seen, they do not mix the > 'miscreants' with the juvenile delinquents, repeat offenders, and > the teenagers who are obviously on their way to the dead end. Almost all teenagers are on their way to a dead end. It is called "Adulthood", which if you look at it a certain way looks a lot like A Dolt Hood. I don't necessarily think it is a bad idea to mix kids (mid to late teens) picked up for "real" crimes in with "real" criminals, but then I don't think that staying out late should be a crime. Fear can be a powerful motivator. > what is the penalty? call their parents for a ride home. they > are not fingerprinted and mugged, etc. very few are required to > even see a social worker. consistent repeat offenders eventually > enter the system --as they should. Really, I should be in "the system" because I like wandering around at night? Real libertarian of you. > >.I still urge Attila to rethink his enthusiastic support of state-enforced > >.curfews, or state-imposed bans on alcohol (not that I recall him supporting > >.this particular law), etc. > actually, the curfew laws are local laws, and I reluctantly > decided to support curfew laws for minors after looking at the > means and results --it does provide an early point of intercepting > behavioral patterns with the *parent* being the judge and warder, > and hopefully give those parents a wakeup call they need to guide > their children as they are fast approaching adulthood where they > are fully accountable. Mr. May's usage of "state" means "governing body" rather than "state of the union". But you knew that. There are many other "interception" points that can be utilized to identify children whose parents are not providing them with the state approved ideological underpinings, Let's take a look at some shall we? Your children do well in school correct? Straight A's in most classes? it is obvious that you are driving your children too hard, teaching them tp be overacheivers. You shouldn't push them so hard, they should stay at the level of their classmates. Ok, that was hyperbole. Seriously tho', if you talk to many "social workers" <pardon me--*spit*> they can give you certain behavior patterns that indicate a child is being abused in the home. They could (and I am sure some would like to) go so far as to include certain types of religious and political indoctrination as abuse. If the state (city/county) mandates it, and it gives the apperance of "stopping crime", or simply provides a smooth surface, is it worth it? alcohol is available at any large grocery store; it has not been > banned to any extent since prohibition, but not necessarily avail- > able in rural areas. Not in your area, and maybe not my LDS's, but try Pell City Alabama. Same mentality, different name on the church house door. > I do not think you can prohibit anything from adults --drugs, Can, or should? Let _me_ run the DEA, and give me a good budget, and I will stop it. Yeah, people will die, but they are dying anyway. > certainly we are justified in ranting against any abridgement of > our right to freely (and privately) communicate, freedom of > *peaceful* assembly, a truly free press --certainly not the New > World Order blinded press printing the official line dictated by > political/economic Boss Tweeds of what is effectively an oligarchy > --they do not possess common principles sufficient to even be > called 'national socialists' (fascists). Yet you argue for the abridgement of freedoms based on age. Does the state know better than a parent when a minor is old enough to be out after midnight? > or, there is a government like Washington where they are trying > to, and may anyway, implement President Hillary's "It takes a > Global Village" so the state can dictate everything and raise a new > generation of robots in the mold of their revisionist history which > we are now suffering by attrition.... Which really only pisses most people off because it is a different revisionist history than they want taught. > If Bubba and the President are reelected with a Democratic > Congress, we will not recognize our once almost free country in Or, he will push too far, too fast, and it will snap back in his face. Remember, Klinton can't do it without congressional approval. Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0

A daily warning regarding Dmitri Vulis
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Dmitri vulis is a liar and fills this list with lies, personal attacks and material having nothing to do with cryptography. He also has unnatural sexual urges towards children, animals and other such items.

2 1

Can somebody unsubscribe cyberpromo from CP?
by jim bell 17 Dec '03

17 Dec '03

I think somebody subscribed that Cyberpromo organization to the Cypherpunks list. It needs to be unsubscribed... Jim Bell jimbell(a)pacifier.com

4 3

Bellcore Smart Card Hack
by John Young 17 Dec '03

17 Dec '03

There is more info on Bellcore's research on flawed smart cards at: http://www.bellcore.com/PRESS/ADVSRY96/medadv.html with links to facts of the crypto hack. ----- Thanks to Mr. Ken Bransom at Bellcore.

1 0

Re: Can we kill single DES?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 07:50 AM 10/6/96 -0700, Declan McCullagh <declan(a)eff.org> wrote: >> >1. Is this a good idea? What will happen if DES becomes perceived >> > as insecure? >> That's Declan's department (and other non-clueless journalists - [...] >This is the meme I've been trying to spread -- that 56-bit DES is *not* >secure. In particular, it's N>>20 years old, the NBS originally certified it for five years, and kept recertifying it primarily because triple-DES was too slow on the popular bank computers of the time (e.g. cash machines and then PCs), and hardware implementations of 56-bit DES would need to be replaced if the algorithm were decertified. Public-key encryption was developed a few years after DES, with a solid mathematical background that lets it remain secure today. It's far more secure than DES but far slower, so it's only been practical the last few years. Newer encryption technology which is several times faster and much stronger than DES has been developed over the last decade. >This cuts through all the rhetoric about differences between key >recovery and key escrow, who's going to be in this industry alliance, etc. "Key Recovery" is the latest sleazy meme from the Government. The only difference from so-called "Key Escrow" is that it's deliberately obscure about who gets to keep your master keys, while "Escrow" implies that it's definitely somebody else besides you. >From the "Eternal Vigilance is Better than Hindsight" department, we should have seen this coming and done a pre-emptive strike on the term. One of the papers on Dorothy Denning's web site is a May 20, 1996 SUBJECT: Draft Paper, "Enabling Privacy, Commerce, Security and Public Safety in the Global Information Infrastructure" from OMB, which is one of the Clipper 3 announcements, and it uses the term "key recovery". # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: picture encryption
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 04:04 PM 10/4/96 -0400, you wrote: >Sometime back someone mentioned a program that would hide messages inside a >picture, by replacing the LSB of the color with the message. There are several such programs. The general term is "Steganography", which means "hidden writing", so you'll see programs with names like stego, jsteg, mandelsteg, etc. Look in the usual archive locations such as ftp.ox.ac.uk and ftp.funet.fi. Also, for Romana Machado's stego programs, look at her home page on www.fqa.com. >I was thinking that if they outlawed high strength encryption (non GAK >approved), not letting them realize that you were sending encrypted >information would be an excellent alternative. It's not an _excellent_ alternative, but if it's all you can get, it's all you can get. It helps to use encryption algorithms that don't have special forms, e.g. don't begin with "----- BEGIN PGP" or other easy-to-spot headers, don't limit their output to printable ASCII, and (tougher) don't have other subtleties such as the statistical properties of RSA keys or checksums that can be tested without decrypting. There's been a lot of discussion on the subject here, and there are some stealth-PGP versions that obscure PGP's form. One difficulty with stego'd encrypted data is that it's tough to use it for applications like encrypting voice between your cellphone and the cellphone company, since _they_ won't be implementing it. One suggested place to stash encrypted data is in the low bits of compressed voice on an internet phone product. It's difficult - you need to pick a voice compression algorithm that has room to substitute bits without messing up the voice quality a lot, which means you need to work closely with the compression algorithm. For 64kbps PCM, this is easy (some of the T1 standards already do this to send signalling bits, which is why data is often limited to 56kbps.) ADPCM and Delta Modulation can probably handle it fairly well, though they're generally used only down to speeds of 16 kbps. Tighter compression algorithms have less room for noise, are much more sophisticated, require much more computation, and are probably a lot tougher to use, but they're where most of the internet phone products are. And then there are applications like CU-SeeMe (low-speed video conferencing) which are generally flaky enough that you could toss in the occasional stego frame and blame it on your cheapo camera or the overloaded reflector :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Voice Stress Analysis of Debates?
by jim bell 17 Dec '03

17 Dec '03

At 12:30 AM 10/7/96 -0700, cypherpunks(a)count04.mry.scruznet.com wrote: >PSE/VSE etc relys on a random 8-14 hz fm modulation appearing in the > the 3rd formant band of the voice... the Dektor PSE retailed for approximately 5k in the early 1970's the hagoth hs-2 was the early 80;s for 2k .. The technical details look vaguely familiar, but I probably last read them two decades ago. It doesn't sound like it would be too complicated to implement, with ordinary phase-lock loops, switched-capacitor filters, and other analog building blocks. >I bought 2 VSE units based on a new chip for 89.95 apiece recently... >this was on an article appearing in popular electronics in 1995 I'll have to look that up. Was it a DSP or some analog implementation? Most importantly, does it seem to WORK? >no software as of yet and it would be probably a FFT or DFT based algorithm >running on a sound blaster DSP(hardware DSP only) or as software > on a fast 150 Mhz + pentium I can give the basic facts known... it is a truth >detector only(not a lie detector), background music shows up a stress... >and scrubbing the modulation shows up as constant stress or "possible decption" Yes, it occurs to me that a vocorder-type compression/decompression of the voice would, effectively, remove FM modulation by averaging out short-term variations in voice frequencies. >truth is indicated by the modualtion showing up randomly over small increments >of time... the effect is caused by microscopic tremors of the larynx when the >speaker is relaxed and truthful the larnyx is relaxed and the random modulations >show up,(or the speaker believes what he is saying to be the truth, when lying >or under stress the larybx tightens and the random modulations >disappear indicating stress... it would be nice to have it in software... >to run on a laptop soundboard and spread to the net as widely as pgp... I think it's particularly revealing that the TV networks don't try to use it. They're supposed to be looking for an edge, something to make the news seem more interesting. The political establishment would see the publicizing of this as going beyond an unwritten limitation on the media. Jim Bell jimbell(a)pacifier.com

1 0

Re: Dole web site cracked?
by Rich Burroughs 17 Dec '03

17 Dec '03

At 10:08 AM 10/7/96 -0500, "Bruce M." <bkmarsh(a)feist.com> wrote: >On Mon, 7 Oct 1996, Black Unicorn wrote: > >> Actually, on further examination, looks like a cute little spoof, not a >> hack. >> >> The address for the actual dole page is : www.dolekemp96.org > > But, which one of these DNS entries looks more official? [snip] Heh. www.dolekemp96.org is definitely the address Dole gave at the close of the debate. The fact that the billing contact and one of the domain servers are at "getcaught.com" is perhaps just a fine bit of irony... I tried to connect to www.getcaught.com with no success, so I'm not sure what's there... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0