December 2003 - cypherpunks-legacy

Making Remailers Widespread
by Bill Stewart 17 Dec '03

17 Dec '03

I've been thinking about how to make one-way remailers a widespread commodity, rather than the novelty item they are today. Doing two-way remailers would be better, but that's still a hard problem, and I don't want to widely deploy shoddy two-way-remailers. Suppose we add form-based remailer support to a popular SSL-equipped HTTP server, such as Apache-SSL, by putting remailer.pl and a remailer form in the default setup, which would deploy hundreds of remailers with minimal effort. What would we have to do to make it work well, rather than turn into a public relations disaster and spam explosion? - The remailer script would have to add disclaimers at the beginning and/or end of the message reminding readers that the message is anonymous, and to contact the remailer cabal rather than the postmaster. - Blocking becomes a big problem - it's annoying enough now, when there are a small number of remailers with hard-working operators; we'd need some sort of automated blocking support to make it usable by relatively non-involved operators - A centralized block list (e.g. http://www.remailer.net/block.txt) which all of the form-based remailers could load and reference would allow non-picky operators not to have to handle it themselves - Implementing the blocking list as a web form for people who want to be blocked would make it relatively painless to use; remailer-operators wouldn't have to transcribe email from the remailer-operators list to use it, which helps with other problems. - Of course, once anybody can fill out their name and ask to be blocked, it's possible for spoofers to block people who don't want to be. One approach for preventing this is to implement a three-way handshake - user fills out form, form mails back blocking notice with cookie, user returns cookie to complete blocking - this is a bit messier for mailing lists, but we can ignore... - special-case for "postmaster", who may want to block all of foo.domain instead of just postmaster(a)foo.domain - special-special-case for postmasters of big sites, e.g. aol, netcom, who we may want to ignore? - A sender-blocking list is harder, and may still take human attention - remailer chaining - allow user to put in another Apache-remailer site so we don't have to limit the chaining to known short list of sites. The remailer.pl can send an https foo.bar.com remailer.pl PUT - The remailer form can probably just have field for second site, if empty don't use. I suppose remailer.pl could also automagically add that in when it posts. Technical question: - How do we initiate an http or https PUT from a script? I assume there's probably some perl add-in for posting http/https? Is there a command-line-shell interface that can fetch URLs? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

4 3

Re: Mitsubishi MISTY LSI
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>Does anyone have a reason not to consider this algorithm snake oil? e.g.: > >Was it developed by a well known cryptographer? >Has it been vetted by someone/some organization with reputation? > >I other words, why should we trust it? It was developed by a team lead by Mitsuru Matsui and has been subject to fairly intense analysis, although not by non-Mitsubishi people AFAIK. In any case it's not the usual snake oil. When I last talked to someone from Mitsubishi who was working on Misty I tried to convince them to make details available online, you could try something like www.melco.co.jp to see if there's anything available. Peter.

1 0

Re: Technical difficulties with AP [AP NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 09:07 PM 9/28/96 -0700, Bill Stewart wrote: >Aside from details like dead bodies, vendettas, and government suppression, >there are technical complications with Assassination Politics >that make it more than the simple job Jim Bell is imagining. >Some of them provide ways to defend against AP, and turn it into more like >Extortion Politics. > > [Do I _really_ want to bring up more discussion of AP? > Not sure, but if it's clear that it won't work very well, > it'll be less likely for the government media to freak about :-)] OTOH, if it's going to work, the earlier you're satisfied about that the better, huh? >Let's look at the critical part of the problem - paying the assassin. >The model we've generally been using is that the players are the >victim, the escrow agent who manages the system, an enthusiastic public, >and the assassin or assassins who are competing for the jackpot. All of whom could play multiple roles in difference circumstances, incidentally, at different times. The public should be particularly interested in this process, BTW, because they realize that someday they may want to participate as donors, bettors, or they may have no choice but to participate as...victims. >I can see three approaches to identifying the correct payee: >1) Payee provides physical evidence to the escrow agent - > the traditional approach doesn't work here: since the > escrow agent is anonymous, so you can't mail him the > victim's wallet or finger with well-known fingerprint or whatever. >2) Assassin leaves physical evidence at the scene which the news media > would be likely to report, which payee confirms with escrow > agent, presumably committing in advance (e.g. after the event, > the payee sends a key which allows the escrow agent to decode > the encrypted message that said "I'm leaving a note on the body > saying 'Jacques De Molay is Avenged - Assassin's Guild Member #32767'.") > Works fine for the first couple of assassinations, but after a while > the police will catch on and stop revealing kinky details to the media. >3) The main solution has been the gambling deal - > it's just a lottery on the date of death of the victim, which presumably > the payee will win because he knows when the assassin will strike. > For a lottery to be effective, prospective assassins need to > be able to determine how much the jackpot is and who the victim is, > so they can place their bets and be the closest winner. There are a number of advantages to the gambling scenario. The first, obviously, is that it is, technically, gambling, and gambling is legal in many locales and "accepted" (morally) in most. The second is that being gambling, no participant other than an assassin knows, for sure, that the person collecting the payoff is actually guilty of any crime. A third is that to many people, gambling is fun, which means that they are already primed to partipate. > But the prospective victim can also play, individually or as part > of an insurance pool (which is especially valuable for victims like > "the first IRS agent to be assassinated".) Obviously you don't want > to just bid up the price on your own head, so it needs to be accompanied > by publicity that the IRS Agents' Benevolent Association is placing > a large number of small bets every day to maximize the chances that > _they_ will collect the money rather than the assassins. > If the times that the bets are for are published, you can beat this, > but you also invite speculators to be small bets just before and after > your bets, so it becomes a mishmash and perhaps a race condition. > If the times aren't published, the assassin can make lots of bets > surrounding the planned date of the hit, which is also a warning > to the prospective victim to be careful if the bets on his demise > start increasing rapidly. The way I've envisioned it, the bettor must commit to his prediction, but he then encrypts it so that nobody else knows what he's predicted, either the date or the target, and he must "buy" his prediction by including digital cash. One advantage of this system is that the victim isn't warned (although the victim is already aware of how much money has been donated to fund the prize), but a potential disadvantage is that there might be a collision between the predictions of two or more people. This probably can't be entirely avoided, but it can be minimized by forcing the bettors to compete with their bets. It is impractical for a person who just guesses to make such a bet, against somebody who knows the date. The bettor doesn't reveal the decrypt key to the particular prediction involved unless he chooses to do so; when he does presumably, it's because the prediction has come true. A failed prediction isn't disclosed, so it doesn't alert anyone else, including the "escrow agent" AP organization. The amount of digital cash included with the prediction will be revealed publicly, the moment it is received by the organization, as well as the (still encrypted) prediction. Saving these predictions allows anyone to verify (after the decrypt key has been released) that the prediction actually identified a particular person. This allows the public and the other players to verify that the game is being played honestly. > This does make the AP lottery somewhat of an extortion deal - > by advertising that someone is a target, you're forcing them to > continually make lots of bets. This, of course, is only true if the specifics of the predictions are revealed, which is not the scenario I envision. Obviously, revealing the predictions allows the victim to lay low whever he's likely to be hit, which is why I think that's a bad idea. > But if they've got any way of tracing > money, even partially, it'll help them find the escrow agent, > who can then be targeted for justice of one sort or another. > You're also forcing the assassin to make lots of bets, though in > a jackpot system the successful payee will recover most of it. It is at least conceivable that an assassin won't know the exact date he'll be successful. If he sends a letter-bomb, for instance, he won't know for sure when that letter will be delivered, or the day it will be opened. However, he need merely make two or three predictions, and he won't have to make the last one or two unless the prediction didn't come true on the first day. Multiple predictions does raise his cost, but it will still be economical to do given the probabilities. > To some extent the defense can be fought if the escrow agent > wants to establish a minimum bet, say $100, which an assassin > can afford to make a few of for the targeted day, but the > victim can't keep paying too much. This also reduces the > since of the potential better pool, and therefore reduces > the jackpot and the attractiveness of the job to the assassin. > Lots of people might be willing to spend $5 to contribute; > $100 bets are much fewer, especially if there are enough > targets to successfully overthrow a government. Originally, I had anticipated that the AP organization would require specific payments included with a prediction based on the value of the reward and the estimated probability of the death on any particular day. I was never comfortable with this system, because it would involve a great deal of calculation based on numbers that no particular people know. I don't know whether you saw my idea a couple weeks ago in which I pointed out that it should merely be necessary to allow all predictors to include whatever amount of money they want with their prediction, with the reward split up and paid to all successful predictors, pro-rated based on the size of their contribution. This shifts the burden to the public to estimate the amount they should include, which should be okay since a predictor is probably a fairly good judge of the probabilities associated with his target. At least hypothetically, it means that an assassin might have a portion of his reward "stolen" by another lucky predictor, but this is unlikely and in any case, the fact that this loss was genuine can be verified by all participates after the fact. And a predictor need merely increase the value included with the prediction to increase his pro-rata share of the reward. Jim Bell jimbell(a)pacifier.com

1 0

Re: "Confessing to a felony"
by Greg Broiles 17 Dec '03

17 Dec '03

At 06:30 PM 9/27/96 -0800, Tim May wrote: > >Hearing me say I "exported crypto," a hearsay claim, and happening to find >one or more laptops at my home, weeks or months later, implies nothing. >Legal proof is still needed. Given only a nebulous statement like "I >exported crypto in violation of the ITARs," or "I shipped PGP to Europe," >is not enough for a case even to be brought to trial. > >(If it reached trial, I would expect a defense attorney to move for >dismissal. Absent any evidence that a crime occurred, absent any proof >beyond the nebulous hearsay statement of a "braggart," there is simply no >basis for criminal action.) > >"Stupid bragging criminals" may be common, but bragging is not in and of >itself illegal. There still has to be evidence of a crime. > >"Produce the body." I mostly agree re the "corpus delicti" rule (a confession must be corroborated by independent evidence that a crime has been committed, common law federally, statutory in Oregon (ORS 136.425(1)) but disagree with your use of "hearsay" - statements of a defendant in a criminal proceeding are not hearsay because they're the statements of a party opponent. (In federal court and in Oregon, anyway - in California they're hearsay but admissible as an exception. FRE 801(d)(2), ORE 801(4)(b), Cal Evid Code 1220.) This quote from _US v. Singleterry_ (CA1, 1994) (sorry no F2 cite, found it on a net database of slip opinions) does a nice job of addressing the question at hand: "To begin with, we note that a defendant's own statements are never considered to be hearsay when offered by the government; they are treated as admissions, competent as evidence of guilt without any special guarantee of their trustworthiness. See Fed. R. Evid. 801(d)(2) & advisory committee's note; see also United States v. Barletta, 652 F.2d 218, 219 (1st Cir. 1981). Nevertheless, there is a danger that the jury will rush to credit a confession without seriously considering whether the defendant confessed to a crime he did not commit. As a result, the federal courts have adopted common law rules designed to prevent a jury from convicting the defendant solely on the basis of an untrustworthy confession. The general rule is that a jury cannot rely on an extrajudicial, post-offense confession, even when voluntary, in the absence of "substantial independent evidence which would tend to establish the trustworthiness of [the] statement." Opper v. United States, 348 U.S. 84, 93 (1954). See also Smith v. United States, 348 U.S. 147 (1954); Warszower v. United States, 312 U.S. 342 (1941); United States v. O'Connell, 703 F.2d 645 (1st Cir. 1983). The Court has explained that independent proof of the commission of the charged offense is not the only means of establishing the trustworthiness of the defendant's confession; another "available mode of corroboration is for the independent evidence to bolster the confession itself and thereby prove the offense `through' the statements of the accused." Smith, 348 U.S. at 156." (footnotes omitted) I think the question of what *would* constitute the corpus delicti is interesting; the mere presence of PGP overseas shouldn't be enough. And evidence like PGP's presence on a laptop which had once been overseas, or airline ticket stubs or passport stamps or testimony from a security officer who remembered making the defendant turn on the laptop at the metal detector, or even surveillance camera footage would corroborate the defendant's confession but not establish that a crime was committed. Such evidence would seem to get us closer to the latter test mentioned in _Singleterry_ but wouldn't meet Oregon's test of "some other proof that the crime has been committed" (ORS 136.425) nor California's "the charged crime actually happened" (People v. Jennings (1991) 53 Cal.3d 334, 368) standard. But an ITAR prosecution would occur in Federal court, where evidence which merely corroborates the confession (instead of proving a crime) may be sufficient. (And, of course, this is all just so much jawboning. Not legal advice. I'm inclined to avoid confessing to crimes via the Internet whether or not it seems likely to lead to prosecution or conviction. I've already been to one job interview where the employer had seen (and was unnerved) by my vocal presence on the net.(!?!) Which is OK with me because if I make someone nervous when they read Alta Vista, just wait until they meet me. :) It's time to get used to the idea that whatever we write may come back in 20 or 30 or 40 years, whether we like it or not. I think it'll teach us both a sense of forgiveness and a sense of discretion, but that may take awhile.) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

2 1

Technical difficulties with AP [AP NOISE]
by Bill Stewart 17 Dec '03

17 Dec '03

Aside from details like dead bodies, vendettas, and government suppression, there are technical complications with Assassination Politics that make it more than the simple job Jim Bell is imagining. Some of them provide ways to defend against AP, and turn it into more like Extortion Politics. [Do I _really_ want to bring up more discussion of AP? Not sure, but if it's clear that it won't work very well, it'll be less likely for the government media to freak about :-)] Let's look at the critical part of the problem - paying the assassin. The model we've generally been using is that the players are the victim, the escrow agent who manages the system, an enthusiastic public, and the assassin or assassins who are competing for the jackpot. I can see three approaches to identifying the correct payee: 1) Payee provides physical evidence to the escrow agent - the traditional approach doesn't work here: since the escrow agent is anonymous, so you can't mail him the victim's wallet or finger with well-known fingerprint or whatever. 2) Assassin leaves physical evidence at the scene which the news media would be likely to report, which payee confirms with escrow agent, presumably committing in advance (e.g. after the event, the payee sends a key which allows the escrow agent to decode the encrypted message that said "I'm leaving a note on the body saying 'Jacques De Molay is Avenged - Assassin's Guild Member #32767'.") Works fine for the first couple of assassinations, but after a while the police will catch on and stop revealing kinky details to the media. 3) The main solution has been the gambling deal - it's just a lottery on the date of death of the victim, which presumably the payee will win because he knows when the assassin will strike. For a lottery to be effective, prospective assassins need to be able to determine how much the jackpot is and who the victim is, so they can place their bets and be the closest winner. But the prospective victim can also play, individually or as part of an insurance pool (which is especially valuable for victims like "the first IRS agent to be assassinated".) Obviously you don't want to just bid up the price on your own head, so it needs to be accompanied by publicity that the IRS Agents' Benevolent Association is placing a large number of small bets every day to maximize the chances that _they_ will collect the money rather than the assassins. If the times that the bets are for are published, you can beat this, but you also invite speculators to be small bets just before and after your bets, so it becomes a mishmash and perhaps a race condition. If the times aren't published, the assassin can make lots of bets surrounding the planned date of the hit, which is also a warning to the prospective victim to be careful if the bets on his demise start increasing rapidly. This does make the AP lottery somewhat of an extortion deal - by advertising that someone is a target, you're forcing them to continually make lots of bets. But if they've got any way of tracing money, even partially, it'll help them find the escrow agent, who can then be targeted for justice of one sort or another. You're also forcing the assassin to make lots of bets, though in a jackpot system the successful payee will recover most of it. To some extent the defense can be fought if the escrow agent wants to establish a minimum bet, say $100, which an assassin can afford to make a few of for the targeted day, but the victim can't keep paying too much. This also reduces the since of the potential better pool, and therefore reduces the jackpot and the attractiveness of the job to the assassin. Lots of people might be willing to spend $5 to contribute; $100 bets are much fewer, especially if there are enough targets to successfully overthrow a government. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

2 1

Re: crypto anarchy vs AP
by jim bell 17 Dec '03

17 Dec '03

At 02:06 PM 9/26/96 -0500, snow wrote: >Mr. Beck said: >> Been reading the AP thread, and thought I'd donate some of my views. > >> the Internet. You'd just cause the government to panic, and this >> would have negative effects, it would take ages for them to calm down, >> and the laws they'd pass in the mean time would mean a near certainty >> of mandatory GAK as a condition to switching the Internet back on. >> (Before someone takes me to task for the impossibility of switching >> the Internet off, it all depends on the level of government panic. >> More specifically perhaps they would disconnect key backbones, and >> ISPs briefly while they rushed into effect a few presidential decrees >> outlawing non GAKed crypto, anonymous ecash, remailers, PGP, DC-nets, >> etc.) > > This would be cutting their own throats. There is SO much commercial >and government traffic going across "The Net" that many businesses would >scream bloody murder, and the government would have MASSIVE trouble with >it's agenda. Yes, that "they'll cut off the Internet!" talk doesn't seem to be very practical. Society very quickly develops dependency on inventions. Try to take away their computers and they'd scream; take away their telephone and it'd be worse! Give Internet another couple of years and 50% of big business would be severely impacted should it be cut off. Wait five years and the world would practically stop rotating without Internet. On a related issue, GPS (global-positioning system) contains a de-accurizing mis-feature called S/A, which adds a little error to the location as detected by a receiver. Ostensibly, it was added so that this could be turned on in wartime, to deny the enemy the ability to make 10-meter fixes. Turns out that it was kept on all the time, probably because if it WASN'T it would become politically impossible to de-accurize the system even in wartime. Jim Bell jimbell(a)pacifier.com

5 4

[CRYPTO], or hash, anyway
by P. J. Ponder 17 Dec '03

17 Dec '03

I need a copy of the appendix to the SHA FIPS pub (180-1?) that has the three test texts and corresponding SHA hashes, so that I can test an SHA implementation I'm working with. I have tried the NIST site, and can't seem to get through. If anybody has this test deal, or knows where it is out there on the net somewhere, please let me know. Thanks in advance. (My problem is I keep getting different hashes between an MS-DOS version I'm running and one running on a Linux box, when I ftp the same files back and forth. @#$%. I thought maybe I was having problems with some kind of Line-feed vs. Carriage Return/Line-feed conversion deal, but it also generates different hashes on binary files. So I thought I would test the Linux and the DOS one against the specs in the FIPS, and see which one is hosed up.) -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ to unsubscribe, send to majordomo(a)toad.com a message that reads: unsubscribe cypherpunks in the message body, not the SUBJECT: line. -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

1 0

Re: WARNING: This Message Actually Contains a Question Reguarding Crypto!
by cvhd＠indyweb.net 17 Dec '03

17 Dec '03

>A program called F-Secure Desktop for Windows 3.x and Windows 95 is using >Blowfish with 256-bit keys. It is meant for encrypting the files on your >hard disk and it works nicely together with Windows File Manager or >Windows95 shell. I would say it is one of the best strong and easy to use >HD encryption programs (only that it costs $$). Yes, but how "safe" is a 256-bit key with blowfish? Would it withstand the efforts of big bro' ?

1 0

[NOISE, was CRYPTO], or hash, anyway
by P. J. Ponder 17 Dec '03

17 Dec '03

Please disregard earlier message about finding copy of the SHA document: FIPS PUB 180-1, I found it at: http://bilbo.isu.edu/security/isl/fip180-1.html Thanks, anyway.

1 0

EFF Distributes Terrorist Information On Internet - Wiretaps Needed!! :-)
by Bill Stewart 17 Dec '03

17 Dec '03

The recent electronic newsletter of that suspicious organization calling itself the EFF contains terrorist material: > Received: (from daemon@localhost) by eff.org (8.7.5/8.6.6) id QAA17422 for > effector-comc-exploder; Fri, 27 Sep 1996 16:57:26 -0700 (PDT) > ^^^^^^^^^^^^^^^^^^^^^^ Comic exploders? How totally un-American. They must be stopped! Because a MIME is a terrible thing to waste.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

2 1