December 2003 - cypherpunks-legacy

RE: RE: Binding cryptography - a fraud-detectible alternative to
by jim bell 17 Dec '03

17 Dec '03

At 11:48 AM 10/13/96 +0000, everheul(a)mail.rijnhaave.nl wrote: >To explain the backround of "binding cryptography" once more; with >respect to (interoperable, worldwide) security in the information >society socities/governments have to achieve two tasks: 1. >stimulating the establishment of a security structure that protects >their citizens, but which does not aid criminals. I think this is a phony distinction. Practically every product sold today could arguably "aid criminals." It isn't possible to prevent this. And that's the problem with your thinking above: If government argued that it had the authority to regulate any product that, arguably, "aided criminals," then it would automatically be able to regulate anything. > 2. Coping with the >use of encryption by criminals outside of this framework. > >An inherent problem with these tasks is that different >socities/governments have different views on the matter. Given that item we just read about Burma illegalizing the non-authorized use of fax machines and modems, that is a vast understatement! > So to achieve >the first task you'll need a concept behind the security structure >that is flexible enough to incorporate *any* crypto policy, i.e. from >liberal (Japan) to non-liberal (France). Just a second! WHy should technology bow to government policy? Until now, the microcomputer industry has pretty much developed and sold products without much or any (?) regard for what governmental policy would desire. In fact, it isn't even clear that governments have had much opinion about the direction that the microcomputer markets should go. Why should we start adjusting business policies and product capabilities in a way which is hostile to customers, just because the government wants this? > We believe that "binding >cryptography" is flexible enough to achieve this: a liberal crypto >policy might use no Trusted Retrieval Parties at all, while a very >non-liberal country might want one (government controlled) TRP, a >compliance check on all network traffic and a ban on other crypto. Why not ___NOT___ help these guys out? Do they somehow deserve to be assisted in the subjugation of their people? Does the name "Zyklon B" ring a bell? >With binding cryptography the issue on a crypto policy becomes >non-technical and politically debatable: which features does a country >want and what implementation? I would much prefer a situation where freedom is provided and/or guaranteed by technology, and it is NOT debateable! See, one problem is that contrary you your implication above, where you said that crypto policy becomes "politically debateable" (which implies that the ordinary people of a country have some input) the _reality_ is that any such decision will be made by a tiny number of bureaucrats, if they can get away with it. The US Clipper proposal was a classic example of this: There was absolutely no public discussion or debate on it before it was announced, and it was obviously intended to be a fait accompli. Further, nearly all non-governmental people who are aware of the crypto issue disagree with the government's policies in this matter. Clearly, you cannot imply that crypto will REALLY be "politically debateable"! >> For this kind of application, binding cryptography is spot on. >Jim bell[SMTP:jimbell@pacifier.com] wrote: >> I think the biggest problem with allowing "anyone" to check the >> correctness of a key is that what is a technical possibility today, >> will become a legally-mandated requirement tomorrow. What if >> Internet backbone companies and/or ISP's were told that they had to >> implement software check these keys, and if they discovered an >> "incorrect" escrowed key, they were legally obligated to either >> refuse to forward that message, and/or forward a copy of that >> message to someone like Spooks(a)NSA.gov or Thugs(a)DOJ.gov. > >The information society is international by nature; we want to >securely communicate with Singapore. If Singapore, a democratic >country!, has such a crypto policy that they want the above control, >then so be it. Don't blame "binding cryptography" for making that >possible, but start a dialogue with your politicians on what features >of the proposal are acceptable in your country. No, I think I _will_ blame your infernal invention for trying to make limited communication possible! There's no doubt that the leadership of places like Singapore might want to restrict communication, but on the other hand they also want to be connected to the rest of the world for "non-political" speech. In effect, they are forced to make a choice. Most countries, except for a very highly authoritarian few, will probably opt for connectivity and this will lead to increased freedom for the people in their countries. _YOU_ are trying to give those governments connectivity while maintaining tyranny. Are you proud of what you're doing? > >Some countries seem to have the philosophy that "law-abiding" citizens >should have nothing to "hide" from their government, so should not use >encryption at all. I think that that is not acceptable. The concept >behind the third-party checking is that no "law-abiding" citizen >should have any problem that abuse - and only that - of a *voluntary* >system can be "seen" by many parties. I think the terms "voluntary" and "abuse" are contradictory in your statement. If the system is "voluntary," then it is presumably "voluntary" to use a non-conforming system, right? And unless the government's goal is to harass or imprison or fine the user for not using that "voluntary" system, there is no purpose in knowing whether a person's use of encryption meets that "voluntary" standard. >If and *how* checking is >done, is a matter of each society. The same concept holds for many >things in life and is well accepted. I see: "How each society decides to use our thumbscrews is totally voluntary and up to each country!" Pardon me while I puke. > For instance that is why cars >have registration plates: if a car drives through after an accident on >a *public* road, then by-standers (third parties) can observe that. I >for one don't the information society to be the wild west, where >anything goes. I'm much closer to "the wild west" than you are, and I like it just fine. I prefer it much better than the tyranny of stratified societies that have enslaved people for over a thousand years. >Of course, people are rightfully worried that such a checkable system >might be abused by a totalitarian regime to control their citizens. >However, as long as such a system is voluntary I see no problem. Maybe you need to remember that the way governments use it, the definition of the word "voluntary" tends to pick up a rather Orwellian meaning. Also, you need to remember that the difference between a "voluntary" and a mandatory system may be as little as a single law passed in the middle of the night by a legislature. A law which you are intending to make possible! > Signs >in the USA indicate (cf. the NRC study & remarks of the president) >that use of other systems will always be possible. You seem to have ignored by conjecture, where I pointed out that Internet backbones and ISP might, hypothetically, be required to check keys and report "violations" to the government on a moment-to-moment basis. Further, they might be prohibited from forwarding messages that do not conform. This gets us back to the definition of the world "voluntary," again. Even if such an eventuality should occur, the government could cynically say that use of non-conforming forms of encryption were still "voluntary," because it's true you could use them. But they wouldn't be very useful if they didn't propagate on the Internet, now would they? >Also, the above >discussions already showed that if such a system is voluntary, then >there are lots of way to go around it. Not if the cooperation of everyone else is coerced! And moreover, not if they are coerced into not dealing with anybody who doesn't go along. You must really hate freedom, huh? Jim Bell jimbell(a)pacifier.com

7 6

Re: pgp, edi, s/mime
by Hal Finney 17 Dec '03

17 Dec '03

Thanks for the kind words about my participation with PGP Inc. My comment was really meant more as a disclaimer, though. Realize that I am now a corporate employee in the field rather than a hobbyist, so set your mental filters accordingly. Also, my activities right now are mostly a matter of helping with the finishing touches. Hard work over the past couple of years by Colin Plumb and Derek Atkins has produced the bulk of the code base for PGP 3 and the follow-on products. Still it is very exciting and gratifying for me to be working in this field which I love and which is so important, and I am enjoying it very much. Hal

2 1

Camelot PRNG
by inssdl＠dstn21.dct.ac.uk 17 Dec '03

17 Dec '03

In the UK, the National Lottery is run by a company called Camelot (in case anyone didn't know) A while back, they introduced a new option, in that if you checked a certain box on your ticket, 6 numbers would be 'chosen' for you, presumably 'randomly' Does anyone have any info on how this system works? i.e. The PRNG used? Whether the PRNG is in the shop terminal or at the central computer @ Camelot? et cetera. (I am looking at the problems of PRSG for my Masters dissertation - hence the interest) Please reply either to the cypherpunks list or to my e-mail address if you think this doesn't have any crypto-relevance. Thanks in advance... ********************************************************************** David Lucas PGDip Software Engineering @@ BEng(Hons) Civil Engineering Postgraduate Software Engineer, University of Abertay Dundee, SCOTLAND @ E-mail: inssdl(a)dstn21.dct.ac.uk @ 2+2 = 5 for large values of two @ If you're not living on the edge, then you're taking up too much space Organisations can't have opinions, only people can and these are mine. Dave's Doorstep is back!!! - http://river.tay.ac.uk/~inssdl/index.html **********************************************************************

1 0

Re: SPA sues C2, other ISPs and users
by Douglas Barnes 17 Dec '03

17 Dec '03

I just wanted to weigh in on a couple of points that have been raised with respect to the SPA lawsuit against C2Net: 1) I don't think this is some sort of evil plot by SPA members because we hadn't joined or because we're competing with some of their members. A lot of their members compete with other members and non-members and nothing like this has happened before. It's pretty clear that they were oblivous to a great many things, including the fact that we're primarily a software company these days. 2) As obnoxious as the lawsuit is, we don't miss the humor in the fact that we've been grumbling (on-line and off) about folks who pirate Stronghold (our commercial, secure version of the Apache web server). We really were looking into joining the SPA, to see if it would do us any good in dealing with this problem. 3) If you run across any mention of this lawsuit in the media, either on-line or in print, it would be great if you could forward it to me at cman(a)c2.net, or fax it to me at: 510 986 8777. I want to be tracking the press coverage very closely, and our clipping services takes about 5-10 days to read and process clippings for us. Thanks for your help, Douglas Barnes VP Sales & Marketing C2Net

2 1

WOW!
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I just totaled up the "Bring Dimitri to San Francisco" pledges. The pledges add up to an amazing US$681 and some guava pastries. Airfair should be around US$300. That, plus hotel should come in under the amount pledged so far. I'd still like additional pledges, however, I want to be certain we're covered and as an expression of the mood of the list. I intend to front the entire amount myself and then ask the "pledge partners" for a pro rated payment based on the actual cost and their proportionate pledge amount. It's interesting to me that several pledges have come from list members who are far removed from San Francisco. One or two of them plan to attend Dimitri's meeting, but most just want to have it happen. I've only had one request for anonymity, but I have kept names confidential without a clear go-ahead from them. (If you have already pledged or pledge in the future, please let me know if you mind if I post your name/nym.) Now there's only one thing missing--Dimitri's response. My open letter to him contained an explicit and unambiguous invitation to address a Cypherpunk meeting on any topic he wanted. I asked him for a clear yes or no, but have received nothing. Perhaps Dimitri prefers shooting from ambush. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 6

AW: binding cryptography
by Eric Verheul 17 Dec '03

17 Dec '03

On dinsdag 15 oktober 1996 14:09, Roy M. Silvernail[SMTP:roy@sendai.scytale.com] wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In list.cypherpunks, everheul(a)NGI.NL writes: > >> BTW, some people on the cypherpunks list seem to think that you can't = >> fraude with a *voluntary* system. However, that is possible: when you do = >> not comply with the *agreed* rules of conduct then the phrase "fraude" = >> is appropriate. >If the system is *voluntary* and I do not *agree* to participate, then I >*cannot* be breaking any "rules". That is correct. Sorry that the BTW-statement is so evident. Some people did not understand that if you *do* agree, then you *can* be breaking any rules... >>> Can you imagine what would happen if governments would (help to) set up = >> a system that has no safeguards at all, i.e. that could give criminals = >> all the anonimity and confidentiality they need? Governments can't = >> probably prevent criminals and the like to use encryption to stay out of = >> sight of law enforcement agencies, but they should not facilitate them = >> either. In the next few years all kinds of "standard" commerical = >> software will come on the market with all kinds of standard security in = >> it. I don't want criminals to be happy with Custom of The Shelf products = >> for security, let them work for their security. > >Which they will, and presumably already do. Therefore, your proposal >does not and cannot hamper criminals. Therefore, your proposal only >hampers law abiding citizen-units' access to uncompromised crypto. I do not agree. For instance, the encryption possibilities of wordperfect, and MS-word are weak; my mail-system (ms-exchange) does not have any encryption at all. The security of these important Custom of The Shelf products can and will be enhanced.. >No institution can expect compliance from a sector of society that, >by definition, does not agree to or follow the social contract. >Therefore, any and all such attempts to do so must be for the purpose of >controlling those citizen-units that do abide the social contract. To >claim otherwise is absurd. The point is that public available systems should *aid* not them in their criminal activities, let them search for alternatives. Compare it with the legislation we have here on the sell of guns. You sort of say: hey, that does not help cause criminals will get it somewhere. I say, that is true, but it will make their lifes more difficult, or maybe I should say less easy. > >> The bottom line is that law-abiding citizens = >> always have to give up some of their freedom to stop criminals (that is = >> why you have to have registration plates on your car, a lock on your = >> car, bicycle, house etc.). That is a fact of life; one I hate. > >Registration plates do not "stop criminals". Locks do not "stop >criminals" (although they might slow a criminal down). Neither will >compromised crypto "stop criminals". But all the above impinge on my >liberty. Am I to give up yet another freedom? Our system slows down criminals too, or maybe I'd better say does not speed them up. Locking my house and my car, certainly limits my freedom too because it gives me the risc of losing the key (happened a few times). Finding the middle of losing freedom by law-abiding citizens on the one hand and stopping criminals on the other hand is an important issue in any democracy. We believe our system gives a solution in which every democratic country on his own implement to their middle, without losing connectivity with countries that think otherwise.

1 0

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by Hal Finney 17 Dec '03

17 Dec '03

The "blinded identities" problem is one of the oldest that we have discussed here (although not much recently, of course!). It is basically similar to what cryptographers call "blinded credentials" and is closely related to electronic cash, as Michael Froomkin's example from Stefan Brands points out. I posted an idea a few years ago for how to use the technique to solve the related problem of remailer abuse. A simple way to approximate what you want is to use a standard blinded signature exactly as is done with David Chaum's DigiCash. The customer comes to you and presents some proof of identity. This may be in person via standard paper documents, or on-line via some cryptographic credential as you suggested. You make a list of all of your customers, and make sure that this customer is new, someone you haven't seen before. Now you simply give him a blinded cryptographic signature, of exactly the same form as the blinded coins given out by DigiCash. He unblinds it, and he is left with a signed credential from you, but one which is unlinkable to his identity. When he interacts with you, he displays this credential as proof that he is a customer in good standing. If he violates the terms of your contract, you disable the credential (add it to a list of bad credentials). He can't use this one any more, and he can't get a new one because he is on the list of people who already got their credential. This simple solution suffers from several problems, some of which are endemic to this class of solutions and others which can be addressed with fancier crypto. Among the fundamental problems we have first that verifying identity reliably is difficult to impossible. If people are motivated badly enough, they can forge whatever documents they need. Then they keep signing up with new identities like the kids who use AOL throwaway accounts. Second, if the customer ever loses his credential, he is screwed. He comes to you with some sob story about how his disk crashed and his dog ate his backups, but you have no way of knowing if he actually lost his credential, or if he is an abuser who got his credential cancelled. Another problem is that groups of users can share credentials, so that some hacker club can get a bunch, one for each of them, and then they can all abuse your ISP, getting credentials cancelled, but able to keep going as long as one is left. Problems which can be fixed include that credentials could be stolen, like phone card numbers, so an innocent person gets his credential cancelled and then we are back to the second problem above. You can mostly solve this by having him create a key when he first registers with his credential and require all his interactions to be protected by this key. There are also more elaborate solutions where he wouldn't actually send his credential over, but use zero knowledge techniques to prove that he had one. Unfortunately David Chaum has a pretty good set of patents covering blind signatures, so for a commercial venture you'd probably have to look into the legal situation. I can send you a list of Chaum's patents in the area if you want it. (I had it on my web page but my ISP quit so I need to get a new page going.) Some of the other practical issues are also mentioned in Michael Froomkin's article, like waiting a while after you get your credential before you use it. Hal

3 2

Crypto: Systems & Application Developers Wanted
by SPYRUS 17 Dec '03

17 Dec '03

SPYRUS, the leading provider of cryptographic tokens (PC cards & Smart Cards), with associated systems and applications software, is looking for engineers with the following qualifications to work with our Secure Applications Group in San Jose, CA: * 5 or more years experience in systems and applications software design and implementation in C and C++. Assembler experience desired. * Minimum 3 years experience with Windows development including device drivers and VxD's, using Microsoft and Borland compilers, NuMega tools, etc. Windows MFC, NT kernel, and Unix (any versions) experience desirable. Mac experience a plus. * Cryptographic and other security software expertise highly desirable. Gregg Weissman SPYRUS San Jose, CA Voice: 408-432-8180 x225 Fax: 408-432-8415 email ASCII resume to: gweissman(a)spyrus.com - or - msutherland(a)spyrus.com see the SPYRUS page at http://www.spyrus.com

3 2

RE: binding cryptography
by Eric Verheul 17 Dec '03

17 Dec '03

Ulf Moeller[SMTP:um@c2.net] wrote: >: liberal (Japan) to non-liberal (France). We believe that "binding >: cryptography" is flexible enough to achieve this: a liberal crypto >: policy might use no Trusted Retrieval Parties at all, while a very >: non-liberal country might want one (government controlled) TRP, a >: compliance check on all network traffic and a ban on other crypto. > >I doubt that even French internet providers would want their routers >to perform six modolo exponetiations and four modolo divisions >whenever someone opens a secure socket... They could, however, take random checks which could also be performed off-line (after the connection was established or even already finished again). Remember we called it fraud-*detecting* not fraud-*preventing*. BTW, some people on the cypherpunks list seem to think that you can't fraude with a *voluntary* system. However, that is possible: when you do not comply with the *agreed* rules of conduct then the phrase "fraude" is appropriate. The same holds, for instance, when you make copies of microsoft word and resell them. Then you don't comply to the rules that you voluntarily agreed to when buying it... > We offered a solution for the *first* task not for the *second*; the > point is that criminals(!) do not gain any real advantage from using > the system in that way as they - among other things - still face the > key-management problem. The above dicussions are only relevant in > countries where the use of crypto outside the structure would be > prohibited. > >Of course, criminals do get real advantage from this system. They can >use strong encryption for their messages and super-encrypt them using >"binding" cryptography. So their illegal messages look perfectly >inconnous as long as their government trusts in the "binding" property >of this scheme. Only when the GAK key holder tries to decrypt a >message, they notice that they cannot read it. I agree, that is inevitable. > >Can you imagine that anyone would ever create a program that tries to >look like a conforming implementation, but generates invalid "binding" >data -- when it is so much easier to simply use PGP, and (if >necessary) disguise that fact using the government-approved encryption >software? I don't, so in my opinion the verification process is >abolutely useless. Can you imagine what would happen if governments would (help to) set up a system that has no safeguards at all, i.e. that could give criminals all the anonimity and confidentiality they need? Governments can't probably prevent criminals and the like to use encryption to stay out of sight of law enforcement agencies, but they should not facilitate them either. In the next few years all kinds of "standard" commerical software will come on the market with all kinds of standard security in it. I don't want criminals to be happy with Custom of The Shelf products for security, let them work for their security. One might say, binding cryptography, like several >other cryptographic protocols, is a nice 'solution', but one with no >corresponding 'problem' in the real world. :) It doesn't help in >legitimate law enforcement, but it causes trouble to network operators >and it deprives law-abiding citizens of their privacy. We have set up the TRPs in such a flexible way that anybody could find one he can trust, one might even set up his own TRP. Also in the paper we describe how two or more TRPs could be used. Maybe some countries don't want TRP at all. The bottom line is that law-abiding citizens always have to give up some of their freedom to stop criminals (that is why you have to have registration plates on your car, a lock on your car, bicycle, house etc.). That is a fact of life; one I hate. So the point is: where is the middle of giving up freedom and stopping criminals? Well, I think that our concept gives a flexible way of implementing any national middle.. I agree with some of the poster to cypherpunks that governments involves the general public too less in the determination of this middle (some posters said it more strongly). Cryptopolicy is not a binary discussion; although some posters on this list seem to think so. >And criminals don't face "the key-management problem". In any GAK >scheme, the official keys can be used to certify other un-escrowed >encryption keys. Binding cryptography makes it just a little easier, >because there is no need to create any "illegal" key pairs. Everyone >can encrypt messages using the government-certified ElGamal keys, >and then repeat that process, this time including the data required >for goverment access. > that use of other systems will always be possible. Also, the above > discussions already showed that if such a system is voluntary, then > there are lots of way to go around it. > >Criminals will always find ways around these systems -- even if they are >mandatory. Just those who actually "have nothing to fear", will not >go in the risk to use illegal encryption. So governments can wiretap >law-abiding citizens, but not criminals. What useful is a system like >that? > You are absolutely right. However, as said above if governments (help to) set up a security system then they should at least attempt to make criminal abuse difficult. The lock on my bicycle is not really 100% either (as I found out quite to often); if I'd no lock at all I would have a lot more problems. Also, I am *not* for a mandatory system. Best regards, Eric

3 2

Re: exporting signatures only/CAPI (was Re: Why not PGP?)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Steve Shear <azur(a)netcom.com> writes: >> >The problem however, is finding a non-US site to hold the hot potato >> >once it has been exported. For example 128 bit Netscape beta was >> >exported a while ago. I don't see it on any non-US sites. This is >> >due to Netscape's licensing requirements, you need a license to be a >> >netscape distribution site, the license doesn't include the right to >> >mirror non-exportable versions on non-US sites. >> >> That's one good application for remailers, and .warez newsgroups. at. > >I don't know of any advertised files by email services using nym >servers, where the file request, and the files are both sent via >remailers. > >The problem with this is currently is that the nym servers couldn't >stand up to the scrutiny if SPA or whoever got interested. The >message flood attack on the nym would reveal the services host. > >The BlackNet architecture solves this problem by posting requests >encrypted with the services key to a newsgroup, but USENET newsgroup >disitribution time is slow (*), and people are spoilt these days with >WWW, and expect results now, not days later. Has anyone tried this to see whether the LOS would or wouldn't be acceptable? > >The requested file can be posted via mixmaster. You would want to use >a different, random chain of remailers each time. A reverse message >flood could reveal the host also, as you can request lots of copies, >and the service will blindly serve the files. (If someone wants to >discover the service host, they send 1000s of requests, then sit back >and watch which user sends most data into the remailer net.) On a related note: I've been charged with developing an Internet service which needs to assure its clients of anonymity. However, we fear some clients may abuse the service and we wish to prevent the abusers from re-enrollment if terminated for misbehavior. (In your example, it would be the person(s) trying to discover the service host via flood). My thought was to base enrollment on some sort of 'blinding' of their certified signature (e.g., from Verisign) which produces a unique result for each signature but prevents the service from reconstructing the signature itself (and thereby reveal the client's identity). I'm calling this negative authentication. Have you come across anyone who has considered this problem or another one which is mathematically very similar? > >To combat this the service could impose a limit on the number of >copies it would serve per day. This allows a denial of service >attack, if someone wants to stop anyone else getting a copy, they just >saturate the service. Still an improvement over no limit. If the service could negatively authenticate users it would need such limits and might not be subject to such attack. > >Of course Ross Anderson's `eternity service' provides the general case >solution for distribution of such data. It is complex to implement >well though. I've never heard of the eternity service. Where can I get more information? BTW, would Eric Hughes' Universal Piracy System also solve such a situation, by distributing or parking snippets of encrypted file data across many 'cooperating' ftp (or whatever access/storage mechanism) sites. Perhaps the negative authentication approach would help here too by preventing flood/denial of service attacks against the 'key' sites. If only snippets of encrypted data are stored on any one host it might make the SPA's goal even more elusive legally. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

5 4