December 2003 - cypherpunks-legacy

Crypto: Systems & Application Developers Wanted
by SPYRUS 17 Dec '03

17 Dec '03

SPYRUS, the leading provider of cryptographic tokens (PC cards & Smart Cards), with associated systems and applications software, is looking for engineers with the following qualifications to work with our Secure Applications Group in San Jose, CA: * 5 or more years experience in systems and applications software design and implementation in C and C++. Assembler experience desired. * Minimum 3 years experience with Windows development including device drivers and VxD's, using Microsoft and Borland compilers, NuMega tools, etc. Windows MFC, NT kernel, and Unix (any versions) experience desirable. Mac experience a plus. * Cryptographic and other security software expertise highly desirable. Gregg Weissman SPYRUS San Jose, CA Voice: 408-432-8180 x225 Fax: 408-432-8415 email ASCII resume to: gweissman(a)spyrus.com - or - msutherland(a)spyrus.com see the SPYRUS page at http://www.spyrus.com

3 2

RE: binding cryptography
by Eric Verheul 17 Dec '03

17 Dec '03

Ulf Moeller[SMTP:um@c2.net] wrote: >: liberal (Japan) to non-liberal (France). We believe that "binding >: cryptography" is flexible enough to achieve this: a liberal crypto >: policy might use no Trusted Retrieval Parties at all, while a very >: non-liberal country might want one (government controlled) TRP, a >: compliance check on all network traffic and a ban on other crypto. > >I doubt that even French internet providers would want their routers >to perform six modolo exponetiations and four modolo divisions >whenever someone opens a secure socket... They could, however, take random checks which could also be performed off-line (after the connection was established or even already finished again). Remember we called it fraud-*detecting* not fraud-*preventing*. BTW, some people on the cypherpunks list seem to think that you can't fraude with a *voluntary* system. However, that is possible: when you do not comply with the *agreed* rules of conduct then the phrase "fraude" is appropriate. The same holds, for instance, when you make copies of microsoft word and resell them. Then you don't comply to the rules that you voluntarily agreed to when buying it... > We offered a solution for the *first* task not for the *second*; the > point is that criminals(!) do not gain any real advantage from using > the system in that way as they - among other things - still face the > key-management problem. The above dicussions are only relevant in > countries where the use of crypto outside the structure would be > prohibited. > >Of course, criminals do get real advantage from this system. They can >use strong encryption for their messages and super-encrypt them using >"binding" cryptography. So their illegal messages look perfectly >inconnous as long as their government trusts in the "binding" property >of this scheme. Only when the GAK key holder tries to decrypt a >message, they notice that they cannot read it. I agree, that is inevitable. > >Can you imagine that anyone would ever create a program that tries to >look like a conforming implementation, but generates invalid "binding" >data -- when it is so much easier to simply use PGP, and (if >necessary) disguise that fact using the government-approved encryption >software? I don't, so in my opinion the verification process is >abolutely useless. Can you imagine what would happen if governments would (help to) set up a system that has no safeguards at all, i.e. that could give criminals all the anonimity and confidentiality they need? Governments can't probably prevent criminals and the like to use encryption to stay out of sight of law enforcement agencies, but they should not facilitate them either. In the next few years all kinds of "standard" commerical software will come on the market with all kinds of standard security in it. I don't want criminals to be happy with Custom of The Shelf products for security, let them work for their security. One might say, binding cryptography, like several >other cryptographic protocols, is a nice 'solution', but one with no >corresponding 'problem' in the real world. :) It doesn't help in >legitimate law enforcement, but it causes trouble to network operators >and it deprives law-abiding citizens of their privacy. We have set up the TRPs in such a flexible way that anybody could find one he can trust, one might even set up his own TRP. Also in the paper we describe how two or more TRPs could be used. Maybe some countries don't want TRP at all. The bottom line is that law-abiding citizens always have to give up some of their freedom to stop criminals (that is why you have to have registration plates on your car, a lock on your car, bicycle, house etc.). That is a fact of life; one I hate. So the point is: where is the middle of giving up freedom and stopping criminals? Well, I think that our concept gives a flexible way of implementing any national middle.. I agree with some of the poster to cypherpunks that governments involves the general public too less in the determination of this middle (some posters said it more strongly). Cryptopolicy is not a binary discussion; although some posters on this list seem to think so. >And criminals don't face "the key-management problem". In any GAK >scheme, the official keys can be used to certify other un-escrowed >encryption keys. Binding cryptography makes it just a little easier, >because there is no need to create any "illegal" key pairs. Everyone >can encrypt messages using the government-certified ElGamal keys, >and then repeat that process, this time including the data required >for goverment access. > that use of other systems will always be possible. Also, the above > discussions already showed that if such a system is voluntary, then > there are lots of way to go around it. > >Criminals will always find ways around these systems -- even if they are >mandatory. Just those who actually "have nothing to fear", will not >go in the risk to use illegal encryption. So governments can wiretap >law-abiding citizens, but not criminals. What useful is a system like >that? > You are absolutely right. However, as said above if governments (help to) set up a security system then they should at least attempt to make criminal abuse difficult. The lock on my bicycle is not really 100% either (as I found out quite to often); if I'd no lock at all I would have a lot more problems. Also, I am *not* for a mandatory system. Best regards, Eric

3 2

Re: exporting signatures only/CAPI (was Re: Why not PGP?)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Steve Shear <azur(a)netcom.com> writes: >> >The problem however, is finding a non-US site to hold the hot potato >> >once it has been exported. For example 128 bit Netscape beta was >> >exported a while ago. I don't see it on any non-US sites. This is >> >due to Netscape's licensing requirements, you need a license to be a >> >netscape distribution site, the license doesn't include the right to >> >mirror non-exportable versions on non-US sites. >> >> That's one good application for remailers, and .warez newsgroups. at. > >I don't know of any advertised files by email services using nym >servers, where the file request, and the files are both sent via >remailers. > >The problem with this is currently is that the nym servers couldn't >stand up to the scrutiny if SPA or whoever got interested. The >message flood attack on the nym would reveal the services host. > >The BlackNet architecture solves this problem by posting requests >encrypted with the services key to a newsgroup, but USENET newsgroup >disitribution time is slow (*), and people are spoilt these days with >WWW, and expect results now, not days later. Has anyone tried this to see whether the LOS would or wouldn't be acceptable? > >The requested file can be posted via mixmaster. You would want to use >a different, random chain of remailers each time. A reverse message >flood could reveal the host also, as you can request lots of copies, >and the service will blindly serve the files. (If someone wants to >discover the service host, they send 1000s of requests, then sit back >and watch which user sends most data into the remailer net.) On a related note: I've been charged with developing an Internet service which needs to assure its clients of anonymity. However, we fear some clients may abuse the service and we wish to prevent the abusers from re-enrollment if terminated for misbehavior. (In your example, it would be the person(s) trying to discover the service host via flood). My thought was to base enrollment on some sort of 'blinding' of their certified signature (e.g., from Verisign) which produces a unique result for each signature but prevents the service from reconstructing the signature itself (and thereby reveal the client's identity). I'm calling this negative authentication. Have you come across anyone who has considered this problem or another one which is mathematically very similar? > >To combat this the service could impose a limit on the number of >copies it would serve per day. This allows a denial of service >attack, if someone wants to stop anyone else getting a copy, they just >saturate the service. Still an improvement over no limit. If the service could negatively authenticate users it would need such limits and might not be subject to such attack. > >Of course Ross Anderson's `eternity service' provides the general case >solution for distribution of such data. It is complex to implement >well though. I've never heard of the eternity service. Where can I get more information? BTW, would Eric Hughes' Universal Piracy System also solve such a situation, by distributing or parking snippets of encrypted file data across many 'cooperating' ftp (or whatever access/storage mechanism) sites. Perhaps the negative authentication approach would help here too by preventing flood/denial of service attacks against the 'key' sites. If only snippets of encrypted data are stored on any one host it might make the SPA's goal even more elusive legally. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

5 4

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by jim bell 17 Dec '03

17 Dec '03

At 04:28 PM 10/13/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >It is unpublished, but he kindly allowed to me describe it in a paper I >wrote that discussed whether a bank would ever want to take the risk of >allowing bank accounts where it did not know the identity of the customer. Why should that be a problem? It's the customer's money, isn't it? It's not like the bank is making a loan. It's the customer who should be worried...about the bank's identity. Remember "plausible denial." Shouldn't we believe that if a bank cannot know its customer, likewise it isn't responsible for who that customer is? A bank's legitimate interests should not include acting as enforcer for the government, so any system that prevents this from happening is helpful. And I don't think that a bank can ever be embarrassed (assuming bank accounts are anonymous) by it being revealed that some particular bad guy kept his money there, any more than other cash-based (anonymous) businesses are embarrassed if it is revealed that some bad guy used their services. Jim Bell jimbell(a)pacifier.com

4 6

Sameer should sue the SPA
by Matthew Ghio 17 Dec '03

17 Dec '03

Let's see, what can Sameer sue the SPA for... 1) Filing a frivilous lawsuit, of course. 2) Extortion. "Sign this or we'll sue." 3) Libel and Defamation. "SPA's false statements about Mr. Parekh have harmed his reputation as a software publisher, and cost him profits..." 4) Conspiracy to violate the ECPA by demanding logs and records which may contain private/confidential information. (Dunno about this one, but it's worth a shot.) 5) Anything else? How much $ in damages do you think he can get? Also, SPA is going after C2 because one of their customers allegedly had a link to a pirate site - but they have (apparently) not gone after the pirate site itself! Could someone explain to me how there can be a finding of contributory copyright infringement, when there is no direct copyright infringement? Fonovisa v. Cherry Auction is an often-cited case here. In this case, a lawsuit was brought against the swap meet operators only after action had been taken against the vendors of the illegally copied material. It does not seem logical that c2 could be liable for contributory infringement when no actual infringement has (yet) been shown to exist.

4 3

RE: LET'S MEET DIMITRI (WHO CARES?)
by Alex Filacchione 17 Dec '03

17 Dec '03

<FLAME> Hmm. Maybe I am missing something. Can someone please explain to me exactly WHAT relevance this has to the list? People, I really DON'T CARE what your opinions are of Tim May, or anyone else for that matter!!! Can you please stop acting like children in a playground name-calling contest and move on to something else? Something of relevance to the list please? If you absolutely *HAVE* to continue to act like children then take it to private email. If for nothing else, then to save YOURSELVES from embarrassment. </FLAME> Thank you, AlexF(a)iss.net ---------- From: Dr.Dimitri Vulis KOTM[SMTP:dlv@bwalk.dm.com] Sent: Friday, October 11, 1996 8:55 AM To: cypherpunks(a)toad.com Subject: Re: LET'S MEET DIMITRI [snip] No deal, then. I suggest that for your next meeting you book Timmy May to perform live sex acts on stage with his two cats, as Ray and Zach do the Macarena circle-jerk. > How about you and Tim sit down and *NICELY* talk about your differences?

3 2

Re: NSA/GCSB spying shown on NZ television [RANT]
by Dale Thorn 17 Dec '03

17 Dec '03

Clint Barnett wrote: > has anyone seen the Mike Myers flic "So I Married An Axe Murderer"? > His "father" in the movie has an awesome theory about a group of the > 5 most powerful epole in the world running everything, including the > newspapers, known as the Pentavaret. The Vatican, the Queen, the > Gettys, the Rothchilds, and Colonel Sanders before he went tits up. > Not to discredit your information, but you just reminded me of it and > I thought it was funny enough to mention. And I thought this was well worth mentioning on the list: I am always amused (when I'm not absolutely hysterical) at how certain people can sit back and smirk at conspiracy "theories" like the "Bilderberg" agenda et al, then you look around and you see: 1. No major daily newspaper in the U.S. takes any interest at all when these most powerful and influential people meet to discuss the fate of the world. What a surprise, huh? 2. The same people who get on TV a lot and smirk at conspiracies that might be believed in by the little people, don't have any trouble believing in the wildest, craziest, most unbelievable conspiracy of all, as long as it's politically correct, and brings in lots of cash. Screw 'em.

2 2

AOL/remailer testing
by Raph Levien 17 Dec '03

17 Dec '03

Hi cypherpunks, It has come to my attention that there may be problems sending mail from the anonymous remailers to AOL accounts. I'd like a volunteer with an AOL address to recieve a test messages sent by me, and report back to me which mails got through and which didn't. Thanks very much in advance. Raph Levien

1 0

Apologies and Clarifications -
by cypher＠cyberstation.net 17 Dec '03

17 Dec '03

First of all, I would like to sincerely apologize for my personal attacks on Perry. It is the first time that I have ever done that and I apologize for wasting you time and mine in that regard. He is obviously going to try to pontificate and rehash the old forever. Accordingly, to paraphrase Chief Joseph, "from where the sun now sits, I will fight Perry Metzger no more, forever." I further apologize for any offense that you feel that I may have caused. As to other matters: Instead of replying to the attacks being fabricated by Perry and other I have opted to recapitulate the matter at hand as perspicaciously as my limited abilities permit. As we know, Shannon was not a prolific writer. We also know that IT has not advanced very far during the 50 years since Shannon's nascent ground breaking work. Why? Because of the very issues that are at the heart of this matter. The differences between black, white and all the multitude hues of grey in between. I am extremely skeptical, and believe many readers may be too, of people that go around flaunting their understanding of Shannon, entropy and its application in absolute unequivocal mathematical terms. I hold that such a position, except in terms of delimiters, does not reflect an understanding of Shannon's impartations but au contraire, it is evidential proof that they do not have any real appreciation of Shannon at all. That is in no way intended to denigrate Shannon's very important contribution to our endeavors. I embrace the predicate that Shannon in terms of mathematical certainty has only defined the boundary conditions of the playing field within which we must play our games. If we stray outside that field, we are errant in the absolute sense. If we however play within those mathematical certain boundaries, we may be in error for other reasons, but Shannon cannot be cited as the casual agent. The recondite "parti pris" hijacking of the definition of the term OTP on the basis of conflict with Shannon is ludicrous, when such usage is apodictically within Shannon's delimiters. I have witnessed several definitions of an OTP which I maintain are entirely consistent with Shannon. Among such are: An encryption where any ciphertext may in fact be an an encrypted expression of any plaintext of the same or lesser length; or an encryption where the only information obtainable from the ciphertext is the maximum plaintext length; and so forth. All of these definitions have the essential quality that at the bit level, they can be reduced down to the equation: Pb xor Ub = Cb where Pb is a Plaintext bit, Ub is an Unknown bit and Cb is the resultant Ciphertext bit. Of course the combining form is normally XOR, but could be table lookup, modulo additive, or other. The important thing is that so long as only Cb is known, it is impossible to determine either Pb or Ub. If somehow the Ubs can be subtracted or cancelled out, as for instance by any discoverable reusage of Ub, even in a derivative form, then you may be able to recover some or all of the Pbs. The assertion that an Ub must be an Rb, a truly Random bit, is irrelevant ideology unless there exists the means to convert the Unknown bit, Ub, into a Known bit, Kb. That is the sublime basis of the IPG algorithm, which is to generate a stream of "unknown bits" which cannot be analytically reconstituted in the absence of the OTP generator key, and possibly other related key like parameters. The additional caveat of course is that the key cannot be guessed, nor can it be derived from brute force methodologies, both of which are patently impossible with the IPG algorithm. You do not have to be a Stephen Hawking to comprehend why that is a fact; each of you, with possible minor exceptions, will be able to discern that because it quickly becomes self evident as you ply the algorithm. There are those who will advance the contention that the ciphertext cannot in fact represent any possible plain text. That is incontestably true. In fact with reasonably long ciphertexts, say for example an encrypted FAX, unlike a hardware sourced OTP, there will only be one meaningful plain text that can be derived from the resultant ciphertext. Does that mean that a given ciphertext might not represent any plain text of that same, or lesser, length? One would think so, since it obviously cannot. The problem being though, is exactly how do you go about proving that any given plain text cannot be represented by a known ciphertext. There are two prongs to such a proof, both of which must be substantiated in any specific case at hand:. 1. Inclusionary Proof - the one most frequently advanced alone, which simply stated says that since each encryptor stream may represent any possible encryptor stream of that same length, then the ciphertext may be the XOR product of any plaintext of same said length. Obviously, a hardware sourced OTP DOES meet that proof. Also. it is patently evident that the IPG software OTP DOES NOT meet the inclusionary proof test. 2. Exclusionary Proof - which is equally valid, and simply stated consists of two propositions: A. Can any plaintext be encrypted with the OTP? Obviously the answer is YES for BOTH both hardware sourced OTPs and the IPG software sourced OTPs. B. If 2.A is true, is it possible to exclude any plaintext possibility? Obviously in the case of hardware sourced OTPs, no plain text can possibly be excluded. What about the IPG software OTPs? . One method that you could theoretically be used to exclude a possible plaintext for the software OTP, would be to by brute force try all possible keys, until the correct one is obtained. That however, would be difficult to say the least, as a matter of fact it is impossible: If every subatomic particle in our known universe was a Googol, 1 with 100 zeroes after it, of Cray T3E computers - and each of them had been brute forcing a partition of the possibilities at the rate of 1 Googol of them per picosecond which could not be done - but assume that it could - and they had been doing so since the Big Bang say 20 billion years ago - and they were to continue to do so for the next 20 billion years, that is beyond the life expectancy of our solar system/galaxy, and perhaps the universe, then approximately 10^322 of the possible OTPs would have been tried. Thus it would still take 10^34000 times as long as that to try all of the possibilities - that is they would have tried only one part in 1 with 34000 zeroes after it - not theoretical infinity by any means, but a very, very large extra-astronomical number. Brute force is patently impossible. . Another possibility might be to guess it - anyone recognizes that would not be practical, and how would you know that you were right. All of the IPG OTP generator, aka Encryption, keys are themselves OTPs. . Another possibility would to be to analytically exclude the invalid possibilities. As stated previously, and as you can discover for yourself, this reduces itself back down to to the exact equivalent of the brute force method set out above. With the algorithm, there is no difference between analytically exclusion and brute forcing - they are one and the same. So in fact, any known ciphertext may indeed be an encryption of any plaintext of that same, or lesser, length, because you cannot prove that it is not a specific plaintext. Some will contentiously assert that the key and other parameters might be hacked. While we include within the system facilitators that reduce that risk to a minimum, and to near zero if you use simple precautions, it is true that the hacking possibility exists. However, that possibility exists for RSA, PGP, hardware sourced OTPs, or any other form of security or encryption. We are better positioned in that regard than others but in terms of the human element, as we all know, there is no such thing as perfection. With warmest regards, Don Wood

1 0

Alice in Cypherspace
by David Lesher 17 Dec '03

17 Dec '03

I found my copy, if the person asking last week still needs it.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0