December 2003 - cypherpunks-legacy

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by azur＠netcom.com 17 Dec '03

17 Dec '03

>>> >Steve Shear <azur(a)netcom.com> writes: >>> I've been charged with developing an Internet service which needs to assure >>> its clients of anonymity. However, we fear some clients may abuse the >>> service and we wish to prevent the abusers from re-enrollment if >>> terminated for misbehavior. > >At 04:28 PM 10/13/96 -0400, "Michael Froomkin - U.Miami School of Law" ><froomkin(a)law.miami.edu> wrote: >>Stefan Brands has a protocol that probably does what you want. >.... >>http://www.law.miami.edu/~froomkin/articles/oceanno.htm#ENDNOTE286 > >Looks like a really nice paper on anonymity issues; at 485K, it'll take >a little while to read :-) Yes, it was quite a load, but very good material. > >The fundamental difficulty in this problem is that you need some >demonstrable proof of uniqueness for human users; if you don't have that, >you can't transform it into a unique-but-anonymous identity.* >The issues are similar to privacy-protecting voter registration problems. > >Brands's protocol starts with the user going to the bank with proof of ID, >and getting a numerical ID which can be blinded and signed. >It's a nice approach; you can do cruder approaches by hashing your >universal-citizen-unit-ID-number or whatever, but that can be >dictionary-searched >by feeding all the possible ID numbers through the hash. > >For some applications, mapping back to a unique human isn't necessary; >if you do something like map back to a bank account which has a high >minimum balance for setup, this discourages the type of users who >don't want to spend $100 just to send spam. > >Blinding a Verisign signature isn't enough, though - they support >personna certificates without proof of identity. Is it possible to determine the level of Verisign signature to screen out personna certificates? > >[ * There are non-universal-identifier methods for preventing double-use. >Voter registration in many places just depends on identification and >affidavit, and is often abused (e.g. Chicago graveyard voters and >Nevada absentee ballots), but usually not massively abused. >Some third-world countries don't even require registration or literacy - >they dip your thumb in ink after you vote, using a kind of ink that >won't come off for a couple of days. Attacks against this protocol >include better solvents :-) ] Of course, if elections were very infrequent, they could cut off a finger each time you vote :-) You all have given me much to think about. Thanks.

1 0

Re: FLY_not
by jim bell 17 Dec '03

17 Dec '03

At 09:30 AM 10/14/96 -0400, John Young wrote: > 10-13-96. CoWo: > > "Encryption confusion" > > Reminded of the secret Clipper algorithm, I sought > details from IBM. I asked a spokeswoman why the company > hadn't just put out a nice, snappy white paper > explaining its new approach to key recovery. "We spent > three months trying to do that, quite literally," the > spokeswoman said. "It's pretty confusing stuff, and > whenever we get it on paper, we aren't happy with it." That's interesting...whenever they get it on paper, _we_ aren't happy with it either! Jim Bell jimbell(a)pacifier.com

1 0

Clinternet?
by Tom Lojewski 17 Dec '03

17 Dec '03

How do I get off this list? >X-Sender: rah(a)tiac.net >Date: Fri, 11 Oct 1996 12:02:04 -0400 >To: cypherpunks(a)toad.com >From: Robert Hettinga <rah(a)shipwright.com> >Subject: Clinternet? >Sender: owner-cypherpunks(a)toad.com > >Hoo boy. > >I had the most amazing whiff of paranoia from the morning news. > >Clinton wants to buy the internet back for $500 million so he can watch us >better? > >Nawwww, 'course not... > >Cheers, >Bob Hettinga > >----------------- >Robert Hettinga (rah(a)shipwright.com) >e$, 44 Farquhar Street, Boston, MA 02131 USA >"The cost of anything is the foregone alternative" -- Walter Johnson >The e$ Home Page: http://www.vmeng.com/rah/ > > > > --------------------------------------------------------- Tom Lojewski - ProNet Consulting - lojewski(a)earthlink.net

2 1

Re: FLY_not
by wa6ube＠ix.netcom.com 17 Dec '03

17 Dec '03

John Young writes: > >On 10/14/96 09:30:38 you wrote: > > 10-13-96. CoWo: > > "Encryption confusion" > > Reminded of the secret Clipper algorithm, I sought > details from IBM. I asked a spokeswoman why the company > hadn't just put out a nice, snappy white paper > explaining its new approach to key recovery. "We spent > three months trying to do that, quite literally," the > spokeswoman said. "It's pretty confusing stuff, and > whenever we get it on paper, we aren't happy with it." > > 10-12-96. InWe: > > "IBM Coalition May Not Fly" [Thanks, WR] > > "The relaxation on encryption is in many ways an > extortion of industry," said Bob Gargus, president of > the Atalla. "If this starts to happen for export, how > many companies will be able to support two standards? I > think every American should be worried." But Greg Simon, > domestic policy adviser to Vice President Al Gore, said, > "We're not looking for an answer that's universally > popular. We're looking for a solution that's balanced > and fair." > ----remainder snipped----- -----BEGIN PGP SIGNED MESSAGE----- I am curious, if there is this "coalition" of companies that have joined IBM on this new Key Recovery Plan, Has anyone yet found out who the other members of this coalition -----BEGIN PGP SIGNATURE----- Version: 4.0 Personal Edition iQCVAwUBMmOndMDUh3vt7LRPAQEsnQP8Cs9yUdETZjTdZPar236cavjWRspQI/vU 9W7DKgUu0QeknOVmmmfbhQSRx8o6W/NcelVG67hXzIE8Zui5LPBefOpOIr6qHOqc ySzLUXS7l0lq5a7Radc/+WoXM/WoHZXYHX6eU7HsJ7dosn7vZiMG2p75+06BBKA6 MCO5n68h2BU= =jy/0 -----END PGP SIGNATURE----- Patricia Gibbons <wa6ube(a)ix.netcom.com>

2 1

RE: RE: Binding cryptography - a fraud-detectible alternative to
by Hal Finney 17 Dec '03

17 Dec '03

From: everheul(a)mail.rijnhaave.nl > Hal Finney[SMTP:hal@rain.org] wrote: > >Another flaw with schemes of this time (in terms of failing to meet > >their goals) is that they cannot detect superencryption and other > >forms of non-standard encryption of the message body proper. All > >they can really do is verify from the outside that the same session > >key is encrypted for the two recipients (the intended recipient and > >the Government Access to Keys Party - let's not abuse the term by > >calling him a Trusted Third Party). But they can't be sure that the > >session key is sufficient information to decrypt the message. > We offered a solution for the *first* task not for the *second*; the > point is that criminals(!) do not gain any real advantage from using > the system in that way as they - among other things - still face the > key-management problem. The above dicussions are only relevant in > countries where the use of crypto outside the structure would be > prohibited. BTW, it is by such discussions that I believe such a ban > is ineffective and in fact counterproductive. I have not read your paper, but let me illustrate via what may be a similar scheme how criminals can use the key management infrastructure, create messages which look good from outside, yet which still cannot be read by the GAK (government access to keys) people. In ElGamal encryption we start with a message session key M which we want to send across. We have the public key y1 = g^x1 of the recipient (^ is exponentiation). We choose a random blinding factor xm, and calculate ym = g^xm. We send ym and M * (y1^xm). y1^xm equals g^(x1*xm), and the recipient can recover this by ym^x1. Now with two recipients, if we choose the same blinding factor xm for both, we send ym = g^xm, and both M * (y1^xm) and M * (y2^xm). We use the two different recipients' public keys y1 and y2. I believe this can be checked from outside by taking the ratios of these two factors (y1/y2)^xm and using known methods to prove that this is of the proper form. This can be circumvented though simply by replacing M, the true session key, with M' = M*(y1^xm), where y1 is the intended recipient (and y2 is the GAK party). We send M'*(y1^xm) and M'*(y2^xm). Outsiders still verify that this is of the proper form. And the intended recipient can calculate the true M by dividing twice by y1^xm instead of once (in effect M' is the El Gamal encryption of M for party 1). But the GAK party, who gets M'*(y2^xm) and recovers M', finds it useless in trying to decrypt the message. This shows how keys from a standard infrastructure can be used in a slightly non-standard way to confound your scheme. Granted, the parties involved have to share knowledge about using the keys in this non- standard way, but that is only one bit of information and not at all hard to distribute. Hal

1 0

(no subject)
by Jim Alexander 17 Dec '03

17 Dec '03

1 0

[NEWS] Crypto/privacy related wire clippings (per Bill Stewart's request)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

CITIBANK MINES DATA--MARKETING GOALS WARRANT PARALLEL PROCESSING Citibank wants to do more than track its credit-card holders' buying behavior. Soon, it hopes to know what they'll purchase next, and who's committing fraud. Data-mining techniques and data warehouses, part of a project called the Cards Analytical Model (CAM) slated to be completed by the end of 1997, are the tools Citicorp Credit Services in Long Island City, N.Y., hopes to use to predict future consumer patterns. To make CAM work, Citibank's IS team knew it needed a powerful mainframe-class system to handle the complex formulas and algorithms pounding away on close to 2 terabytes of data. But the mainframe wasn't an option. "We didn't want the data warehouse to impact our OLTP (online transaction processing) production," says Kevin Murphy, VP of IS for Citicorp Credit Services. "We didn't have the luxury to give up cycles and drives." Instead, Citicorp chose the IBM RS/6000 SP MPP (massively parallel processing), consisting of 116 nodes (or processors) and 7 terabytes of storage capacity. The database is DB2 Parallel Edition, also from IBM. More than 50 C++ and C developers, from Citicorp and Lockheed Martin, the systems integrator, are working on the CAM project. -- Information Week, 10/07/96 American Banker: Wednesday, October 9, 1996 Card Frontiers Citi Alumna's Consultancy to Focus on New Technologies By Jeffrey Kutler Catherine Allen, the former Citibank vice president and founding chairman of the Smart Card Forum, announced the formation of a consulting partnership, the Santa Fe Group. She is president and chief executive officer of the firm. Former Citibank technologist Ted Fine and entrepreneur Howard Sherman, who helped develop the Midas and SuperCuts franchise operations, are executive vice presidents. The aim is to help businesses understand and assimilate innovations in management and technology. The firm's base, New Mexico's capital city, is a hotbed of the study of complex adaptive systems, a scientific discipline that is crossing over into business management. Ms. Allen said she hopes to "break new ground by applying complexity theory to practical business challenges." She has scheduled a forum, "Complexity and Technology: Organizing for Innovation," in early November. Mr. Fine, who managed Citibank's global consumer systems, said the firm could help "master the challenge" of emerging technologies like the Internet and smart cards. Ms. Allen had been developing the business since she left Citibank early this year. Santa Fe Group has been working on several consulting assignments, but didn't begin widely advertising its services until mid-September. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

SURVEY: Encryption in Commercial Enterprises
by 'Mark' M.J. Saarelainen 17 Dec '03

17 Dec '03

Dear Receiver, I am completing a brief survey of encryption technologies and the uses of this technology in commercial enterprises. I have included three questions below. After reviewing these short questions, I would appreciate greatly, if you could provide your input (your responses) to me. My email address is mjsus(a)ix.netcom.com - thanks in advance. Best regards, Mark --------- 1. In your opinion, what are the 5-10 most significant applications of encryption technologies currently in commercial enterprises? 2. In your opinion, what are 5-10 main barriers currently that may prevent the successful implementation and utilization of encryption technologies in commercial enterprises? 3. What are activities and projects that can be initiated and taken to lower and reduce above barriers (see the question 2.)?

1 0

Service pays users (sort of) to read commercial e-mail
by Greg Broiles 17 Dec '03

17 Dec '03

>From time to time we've discussed the economics of paying per-message costs for E-mail, and/or systems where advertisers pay users to read their messages. Someone seems to have set up a system like that. It's at <http://www.aristotle.org>. They seem to be using voter registration as an is-a-real-person credential. (Their idea seems to be that they'll charge commercial (paper) mailers less than it costs to print & mail junk mail, deliver it (and some of the $) to users, and keep the remainder of the $ themselves. They seem to be sensitive about "reading things you're not really interested in", which strikes me as amusing, given all of the crap that people seem to mail me without special regard for whether or not it's interesting. Advertisers seem happy enough to spend $.40 to mail me their stuff, so what's the harm in spending $.30 where I get $.10 of it, regardless of whether or not I ignore it as quickly as I do paper junk mail? They're saving $.10, and I'm making $.10, and we're not wasting paper. Who's being harmed? As I read their terms & conditions, they don't start paying you until Dec 1997, and you need to accumulate $100 worth of credit to get paid. Also, it only seems to be interested in people from California at the moment. (perhaps that's the only state they've got voter info on so far.) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

RE: binding cryptography
by jim bell 17 Dec '03

17 Dec '03

At 11:16 PM 10/14/96 +-100, Eric Verheul wrote: >BTW, some people on the cypherpunks list seem to think that you can't fraude with a *voluntary* system. However, that is possible: when you do not comply with the *agreed* rules of conduct then the phrase "fraude" is appropriate. No, it probably isn't. I don't know if you're basing your opinions on some Dutch variant of contract law, but as I understand it in order for there to be "fraud" there has to be a contract of some sort. I'm sure a REAL LAWYER (TM) will correct me if I'm wrong, but to have a contract you first must have an agreement, and the parties must either go to an inconvenience or receive a benefit as a consequence of that agreement. Specifically, let's suppose I'm asked to limit myself to sending encrypted messages using some sort of standardized, GAK'd system. Assuming I am willing, I then have to receive some benefit from that agreement (or the other guy must go to some inconvenience) or else there's no contract and no fraud if I cease operating according to that agreement. However, there's a problem: What benefit am I supposed to get sending GAK'd messages? If it's nothing, then there's no contract. (Besides, why should I agree to any "voluntary" agreement if I don't benefit in some way?) If, on the other hand, I get my messages handled by some faster route, or get cheaper Internet service, that constitutes a benefit, but at that point people who don't agree are disadvantaged compared to those who agree. Problem is, this constitutes a subsidy of people who are willing to give up their freedom by people who aren't, and I suggest that there's at least an ethical problem with that, if not a legal or Constitutional problem. And there's a contradiction: You said the system was supposed to be "voluntary." The more government pays (money, service, etc) people to agree, the less "voluntary" it is. To cite an analogy, suppose the government offered money to anyone who agreed to sign away his free-speech rights, to be paid for by taxes collected by the general population. Raise the payments and the taxes high enough, and nobody could afford to NOT sign away those rights. This doesn't sound "voluntary," now does it? >>Can you imagine that anyone would ever create a program that tries to >>look like a conforming implementation, but generates invalid "binding" >>data -- when it is so much easier to simply use PGP, and (if >>necessary) disguise that fact using the government-approved encryption >>software? I don't, so in my opinion the verification process is >>abolutely useless. >Can you imagine what would happen if governments would (help to) set up a >system that has no safeguards at all, i.e. that could give criminals all >the anonimity and confidentiality they need? "all the anonimity and confidentiality they need?" All they need to what? By its very nature, encryption is more easily used to defend oneself against crime, than to commit crime. It's related to the difference between the difficulty of doing an encryption/decryption, compared with the difficulty of decrypting a message by finding the key that you don't already know. This can be a factor of well over a trillion more difficult. This is one reason that most of the people on CP don't fear the widespread development and deployment of good encryption, which I think most of us would acknowledge can't help but "assist criminals" in some proportionately small way. > Governments can't probably prevent criminals and the like to use encryption >to stay out of sight of law enforcement agencies, but they should not >facilitate them either. In the next few years all kinds of "standard" >commerical software will come on the market with all kinds of standard >security in it. I don't want criminals to be happy with Custom of The Shelf >products for security, let them work for their security. "Criminals" are generally happy with off-the-shelf guns, or cars, or many other products. I don't think you have a hope keeping them unhappy with off-the-shelf encryption. >We have set up the TRPs in such a flexible way that anybody could find one >he can trust, one might even set up his own TRP. Also in the paper we >describe how two or more TRPs could be used. Maybe some countries don't want >TRP at all. The bottom line is that law-abiding citizens always have to give >up some of their freedom to stop criminals (that is why you have to have >registration plates on your car, a lock on your car, bicycle, house etc.). I disagree. The very act of using good cryptography can help protect assets without giving up freedom. If it helps me more than it might potentially hurt me, then in fact I've GAINED freedom, not lost it. >Also, I am *not* for a mandatory system. However, given the tendency for governments to redefine the meaning of the terms, it is irrelevant that you claim to oppose a "mandatory" system. In fact, it would be with tricks like your invention that governments would adopt a mandatory system that is called "voluntary." Jim Bell jimbell(a)pacifier.com

1 0