December 2003 - cypherpunks-legacy

RFC on "Assert Your Privacy"
by John Willis 17 Dec '03

17 Dec '03

We are in the process of revising our publication "Assert Your Privacy" and we would like to have the benefit of your input (heah, what can I say, I just joined the list). The doc is generally intended for the mass public and does not yet cover issues like e-cash, credit card transactions over the net, etc.. I have yet to be convinced that a critical mass has been reached to warrant inclusion of same. So, please visit http://soli.inav.net/~dolphin/asrtpriv.htm and provide feedback to the address indicated, or discuss it here! I look forward to learning some things from ya'll! Thanks, John Information Locators

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

American Banker: Friday, October 11, 1996 Smart Card Venture, Once Written Off, Is Perking Up By VALERIE BLOCK SmartCash, a high-profile smart card venture that many industry observers had left for dead, is showing signs of life. The turnabout is so complete, according to some sources, that Visa International may buy the system. People close to SmartCash -- it was formed in August 1995 by 11 major U.S. banks, MasterCard International, Verifone Inc., and the French smart card maker Gemplus -- say it has completed development of an operating system and is attracting renewed industry interest. With MasterCard closing in on an acquisition agreement with Mondex, the smart-card-based electronic cash system developed by Natwest Group of London, Visa is said to be looking closely at SmartCash. Visa refused to comment on the speculation, but a spokesman said, "We have been in longstanding discussions with SmartCash since day one." He said Visa has had "a number of discussions with a variety of vendors." But outsiders are freely throwing Visa's name around. It is part of the same flurry of rumors that has American Express Co. taking a hard look at Proton, a smart card system developed by Banksys, the Belgian national payments association. "Visa is interested in SmartCash," said Dan Cunningham, a former Gemplus executive who is senior vice president of Phoenix Planning and Evaluation, a Rockville, Md.-based consulting firm. Though Visa's stored value card system, Visa Cash, has been trumpeted as a viable application of chip technology, "SmartCash is more robust," said a knowledgeable source who requested anonymity. Visa Cash was built on the Danmont operating system, which was designed for Denmark, a tiny market compared to the United States. SmartCash, with a membership nucleus that included the owners of Electronic Payment Services Inc., began last year with much fanfare. But by April this year, executive departures, bickering among the bankers, and the lack of an operating system left an impression of disarray, and the alliance appeared to have dissolved. Electronic Payment Services, owner of the MAC automated teller machine network, quietly stayed the course. Its operating system completed and delivered just two weeks ago, Smart Cash "is the only stored value system developed in the U.S. for the U.S. market," said Donald J. Gleason, president of the Wilmington, Del., company's smart card enterprise. SmartCash founders MasterCard, First Union Corp., NationsBank Corp., and Chase Manhattan Corp. are out. Electronic Payment Services' owners -- Banc One Corp., CoreStates Financial Corp., KeyCorp, National City Corp., and PNC Bank Corp.-- are still committed. Banc One is "still involved with Smart Cash," said a spokesman. "We want to see it get off the ground and go." "They've got a very viable solution," said David R. Campbell, executive vice president of KeyCorp. "It's a matter of whether enough interest can be generated to put that solution into the marketplace." With chip cards looking increasingly viable, the stakes are getting higher for the bank card associations. Visa made a big publicity splash in Atlanta with a Visa Cash pilot that coincided with the Olympic Games, but the banks are still waiting for proof of a business case. MasterCard did not deliver on the expectations of its cash card experiment in Canberra, Australia. Sources said it was deemed a "disaster" and led to the negotiations with Mondex International, the global consortium put together this year by Natwest Group. Several executives involved in MasterCard's chip card efforts have departed, including Robin Townend, Philip Verdi, and Diane Weatherington, head of the program, who left Oct. 1. Another key technologist, John Tunstall, recently submitted his resignation, sources said. American Express Co. is being paired with the Belgian group that has completed several successful installations in Europe and is supplying the technology for the Exact smart card pilot in Canada. Though many smart card systems are getting under way, especially in "closed systems" such as campuses and athletic venues, creating an open worldwide system is much more complex, involving a more sophisticated approach to security, operating standards, access to automated teller networks, interbank settlement, fraud detection, and other back-office issues. Acquiring a system that has been proven can reduce a system's time to market and could be far less costly for banks and their payment associations, industry experts said. The Mondex system is estimated to have cost $150 million to develop. Many banks are trying out several systems; most in Australia are in Visa Cash, MasterCard Cash, and Mondex in hopes of arriving at the most efficient and cost effective answer. Also critical in developing an open smart card system is "scalability," the power to expand and upgrade the hardware and software as new technological developments occur, without having to reissue cards and terminals. Danmont, the proven system Visa used for Atlanta, is not "designed to migrate," a technology expert said. He said the merchant terminals and smart cards would have to be replaced as heightened security measures are implemented. That would not fly with merchants, who are a hard sell on the concept to begin with. The SmartCash system, which took more than four years to complete, is expressly designed for a changing marketplace, with modular components that can be replaced or upgraded. Mr. Gleason called the effort, which suffered embarrassing delays, "a huge challenge." Trying to recoup the costs by getting the SmartCash coalition back on track is the organization's next task. Though Electronic Payment Services would not comment on membership and future plans, BankAmerica Corp., the big California bank historically aligned with Visa, is said to be in the group. Pilots at member banks' offices could be running in early 1997, said Mr. Cunningham, the consultant. Martha Campbell, a former Bank of America executive, said both the San Francisco giant and Visa were active in SmartCash as of August. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

"Stopping Crime" Necessarily Means Invasiveness
by Timothy C. May 17 Dec '03

17 Dec '03

There are several swirling threads about the development of crypto systems (e.g., "binding cryptography," "key recovery," "one-way traceable e-cash") that are designed to allow law enforcement some ability to track illegal transactions, catch some criminals, etc. Lucky Green and I had a brief discussion of this at my party last Saturday. Specifically, about the reasons some folks are avoiding "true" digital cash, as described in Chaum's papers of the mid-80s, in favor of "crippled" digital cash. We both agree that _any_ system which allows government to act to trace a transaction, or to trace a message, or to gain access to keys, essentially throws away the liberty-enhancing advantages of cryptography completely. That this is so, logically, is almost completely self-evident. If this is not, ask yourself whether the government of Myanmar, known as SLORC, would not use its "Government Access to Keys" to round up the dissidents in the jungle. Would Hitler and Himmler have used "key recovery" to determine who the Jews were communicating with so they could all be rounded up and killed? Would the East German Staasi have traced e-cash transations? For every government extant on the planet, even apparently benign government such as that in the Vatican (*), one can easily think of dozens of examples where access to keys, access to diaries, access to spending records, etc., would be exploited. (* And speaking of the Vatican, there's that little matter of Michael Sindona, Banco Ambrosiano, links to CIA funds in BCCI, and the body found swinging from the bottom of Black Friar's Bridge in London. They're just another power player, with a lot of interest in financial matters. Some say the whole "confession" system worked for a millenium as a surveillance and espionage system without peer.) Any proposal to force traceability of transactions must deal with this reality. What the government considers "criminal" or "suspicious" is often what they consider threatening to their exercise of power, or even of their particular time in power (e.g., the Democrats and their 900 FBI files circulating throughout the White House, looking for dirt on their "enemies," the Republicans. Do you really want Craig Livingstone having GAK?). The recent talk about "catching criminals" misses this point, that governments typically use surveillance powers to control citizens. (Note: I would think Dutch residents should be especially sensitive to this concern, given what happened to them in WW II, when the arriving Nazis used telephone records to locate Jews for extermination. Until recently, Holland had a tendency to carefully think about such issues---I believe phone calls were billed in such a way as to not keep such records, for example). Yes, true digital cash--the fully untraceable form originally discussed--will allow some new channels for criminal activity. Privacy has its price. The ability of people to plot crimes and commit crimes behind closed doors is obvious, and yet we don't demand secret cameras in homes, apartments, and hotel rooms! A point we often make, but one we should always remember. And full untraceability--the necessary criterion for something to be really called "cash"--also stops other kinds of crimes, particularly government crimes. As to fully untraceable digital cash--the real e-cash--we may be the carriers of the torch for this. For whatever reasons, David Chaum is backpedalling on his original points, and is making pro-traceability noises. However, various persons on this list have pointed out that "coin mixes" and other such methods can restore the full untraceability even of Chaum's present system. So, there is hope. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: binding cryptography
by um＠c2.net 17 Dec '03

17 Dec '03

> >Can you imagine that anyone would ever create a program that tries to > >look like a conforming implementation, but generates invalid "binding" > >data -- when it is so much easier to simply use PGP, and (if > >necessary) disguise that fact using the government-approved encryption > >software? I don't, so in my opinion the verification process is > >abolutely useless. > Can you imagine what would happen if governments would (help to) set up > a system that has no safeguards at all, i.e. that could give criminals > all the anonimity and confidentiality they need? Sorry if my formulation was unclear. I ment to point out that it is acutally easier to commit fraud in a way that is undectectable than in a detectable way. So on the assumtion that the concept of binding cryptography is a good thing, this scheme is flawed. But to answer your question: Encryption software has already been available for years. You may argue that PGP is not very user-friendly, but it is secure and every computer user who takes the time to read the manual can use it. So nothing much would happen that will not happen anyway or has already happened. > car, bicycle, house etc.). That is a fact of life; one I hate. So the > point is: where is the middle of giving up freedom and stopping > criminals? But since - as you admit - it is not possible to stop criminals, the question is: Do you want to cause a dramatic drawback in privacy and create new potential security hole just in order to force criminals to do a few hour's work of installing a secure encryption system from the Internet, or when that is illegal buy it on the black market? > We have set up the TRPs in such a flexible way that anybody could find > one he can trust, one might even set up his own TRP. Then it is not even necessary to use additional software to circumvent government access. The user can simply configure himself as TRP for the inner layer of encryption and the official one in the outer layer.

1 0

CyberPromo responds!
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A helpful cypherpunk provided a list of addresses for various postmaster and root accounts in cyberpromo.com. I am now sending my abuse response to wallace(a)cyberpromo.com cyberpr(a)ANSWERME.COM root(a)savetrees.com postmaster(a)savetrees.com root(a)answerme.com postmaster(a)answerme.com root(a)NS3.CYBERPROMO.COM root(a)NS4.CYBERPROMO.COM postmaster(a)NS3.CYBERPROMO.COM postmaster(a)NS4.CYBERPROMO.COM and it's actually generating responses. So far, Sanford Wallace has missed my point several times, assumed that I have been sending mail to the replybot when I have repeatedly stated the reverse, admitted that "someone is spoofing requests from your domain" and threatened to bill $1000 for "reviewing frivolous bills". It appears I at least have his attention. This is only slightly related to the list (via the redirection of the list to Wallace's replybot). If anyone wants to discuss CyberPromo tactics further, please do it via private mail. If enough of us want to talk about it, I'll set up a little list for the purpose. - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmVrMxvikii9febJAQGvBwP/WwtrXXFNWvJLIXYcIkrm12ZAaJZwn76e T6xY4IeJw5zYD73iYYYBcU4k6iR4GQR4ZRyKKRDKSqLXuXD0iXcrXG0LWoAtl/9w nKjPe83hiNYPCQIDwryTb3BZTkXBltTLh9VWjFSTMx7AbYg89mxvNrEPhbtevkIC TRwGZ7q2WF0= =TN2R -----END PGP SIGNATURE-----

1 0

SPA's Press Release
by Sean Sutherland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Wed Oct 16 17:11:03 1996 After researching the SPA's lawsuit for awhile, I figured I might as well post the SPA's press release regarding their lawsuit against C2 to see if it'll spur some more discussion on it. If it weren't for the seriousness of the matter, I would almost be amused by the SPA's lawsuit. Their term, "contributory infringement" is almost like suing the bartender because a customer got into a wreck while drunk. Note the "should have nown." Here's their specification for this, copied from http://www.spa.org/piracy/risk.htm. "Anyone who knows or should have known that he or she is assisting, inducing or materially contributing to infringement of any of the exclusive rights by another person is liable for contributor infringement. " ie - posting of serial numbers posting of cracker utilities linking to FTP sites were software may be unlawfully obtained informing others of FTP sites were software may be unlawfully obtained aiding others in locating or using unauthorized software supporting sites upon which the above information may be obtained allowing sites where the above information may be obtained to exist on a server Then there's their Vicarious Liability for Infringement by Another Person, outlined by: "Anyone who has the authority and ability to control another person who infringes any of the exclusive rights and who derives a financial benefit therefrom, is vicariously liable for the infringement of another person." ie - ISPs who have warez or pirate sites on their system ISPs who have pirates for customers sys admins for newsgroups or IRC where pirate activity takes place It's interesting to note that this web page is entitled "Theories of Copyright Infringement", and the only listing (which I didn't copy) which references a law (section 501(a) of the Copyright Act, to be exact) is direct infringement - -- the kind we all know and love. I'm curious, do the Contributory Infringment and the Vicarious Liability for Infringment By Another Person claims have any legal basis, or are they just the inane rantings they appear to be? In a fair world, this wouldn't stand up in court...but unfortunately, with juries today...you get the point. Anyway, here's their press release, again a direct cut from http://www.spa.org/piracy/releases/netpir.htm. - ---------- SPA Files Copyright Suits Against ISPs and End Users Internet Anti-Piracy Campaign Launched (Oct.10, 1996 --Washington, D.C.) -- The Software Publishers Association (SPA) announced today that it has filed five civil lawsuits for copyright infringement occurring on the Internet. Three of the lawsuits were filed against Internet service providers (ISPs), and the remaining two were filed against individual end users. Additionally, SPA launched its Internet Anti-Piracy Campaign, which includes education and enforcement components, in an effort to educate and work cooperatively with ISPs regarding copyright infringement. ISP lawsuits were filed on Oct. 7 and 8 against Community ConneXion of Oakland, Calif.; GeoCities of Beverly Hills, Calif.; and Tripod Inc. of Williamstown, Mass. The SPA members named as plaintiffs in all three suits were Adobe Systems Inc., Claris Corp. and Traveling Software Inc. In each case, SPA first contacted the ISP and requested that the infringing material be removed, but the ISP failed to respond and cooperate. SPA also filed suit against Jeffrey Workman of Auburn, W. V., and Patricia Kropff of Scottsdale, Pa, on behalf of Adobe Systems Inc., Claris Corp., Corel Corp., Datastorm Technologies Inc. and Novell, Inc. In each of these instances, SPA received reports of alleged copyright infringement on certain Web sites, and with the assistance of the ISPs, tracked the individuals responsible for posting the infringing material. "These lawsuits send a clear signal to ISPs and end users that neither direct nor contributory copyright infringement will be tolerated. The Internet does not provide a safe haven for these types of activities," said Ken Wasch, SPA president. SPA's Internet Anti-Piracy Campaign (IAPC), which is outlined at http://www.spa.org/piracy/iapc.htm, contains information explaining why ISPs may be liable for copyright infringement, the risks involved and seven warning signs that infringing activity may be taking place on the ISP's server. Additionally, ISPs may sign an ISP Code of Conduct to show they have adopted the operating practices encouraged under the copyright law. Upon receiving a report of alleged copyright infringement on the Internet, SPA confirms the unlawful activity and sends a letter to the ISP servicing the infringing user. In most cases, the ISP cooperates and remedies the situation. If the infringing user can be identified -- as alleged in the Workman and Kropff cases -- SPA may then choose to seek action against the end user. If the ISP is unwilling to stop the unlawful activity, SPA may choose to file suit against the ISP. "Our intentions are to work cooperatively with ISPs. A key element of the IAPC is the ISP Education Program devoted to alerting ISPs to their potential liability and providing them with the tools and guidance to protect themselves," said Joshua Bauchner, SPA's Litigation Coordinator. "The IAPC maintains SPA's traditional balance between education and enforcement. We first make contact in an effort to amicably resolve the matter, and only when absolutely necessary do we turn to litigation." An integral part of the cooperative effort between SPA and ISPs is the ISP Code of Conduct. This simple agreement asks that ISPs protect themselves from liability by stopping pirate activity on their systems. In return, SPA will attempt to contact the ISP if it receives a piracy report concerning it -- before initiating other action. Piracy has taken many forms on the Internet. These include making unauthorized copies of software available for download, the posting of serial numbers, cracker and hacker utilities and links to pirate FTP sites. Although many believe piracy is limited to "warez" or illegal copies of software, it extends beyond that narrow definition. Under the law, anyone who knows -- or should have known -- of the infringement and who assists, encourages or induces the infringement is liable for indirect infringement. In each of the actions SPA filed, at least two of the above infringements were present. For additional information please visit the Internet Anti-Piracy Campaign site at http://www.spa.org/piracy/iapc.htm. The ISP Education Program information is available at http://www.spa.org/piracy/ispinfo.htm. To report a case of piracy please contact SPA's hotline at (800) 388-7478, piracy(a)spa.org or complete an on-line intake form at http://www.spa.org/piracy/pirreprt.htm. SPA is the leading trade association of the desktop software industry, representing the leading publishers as well as many start-up firms in the business, home office, consumer, education and entertainment markets. Its 1,200 members account for 85 percent of the sales of the U.S. packaged software industry. SPA press releases are available through fax on demand at (800) 637-6823. - ---end bs - --- Sean Sutherland | GCS/C d- s+:+ a--- C+++ V--- P L E- W++ N++ PGP Key ID: E43E6489 | K- w o O-(++) M-- V PS+ PE++ Y++ PGP++(+) http://pobox.com/~seans | t--- 5+++ X++ Rb++ DI+ D+ G e- h! !r y In UNIX, no one can hear you scream. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMmVdeVZoKRrkPmSJAQHVQQf+O07bjV9CDzKPTzOcSpKNlmtUqE0dUD9R gM1nce4LkG+6xszwt81srAwEmMdFtxe2gF0udB95n1okI5ZYYf9YAqpStXKScdZZ QYb8LpaBoxQFlN1t66m6Hy5VXyx/EKjLYYWGWdvLxKIcxMqvvbx7wym3CHdj0iFq 1chg6s6MVFegFXT7l2EEOlHSkloz4/0fl8v63yXUZDyqd0H6PV05JsfC9vkGWVV1 yXC51nKq29ps5LB8Cm61intpfnDOYtq+ZN1EO91+9CDttDyLgJM1/HMA6HnbgGG8 CVc52Kw0JtahXi7cxKNmSuI1F9YEq00bNTqTqARzKAvha+5mWRZ8Iw== =AuZp -----END PGP SIGNATURE-----

2 1

Q.E.D.
by IPG Sales 17 Dec '03

17 Dec '03

Some of you have sardonically written to say "Nihil Est Demonstrandum," N.E.D. because an OTP must be derived from a hardware source, that is, it must be a pure random sequence of limitless entropy. Accordingly, they unbashfully assert that an OTP generated by a computer program is not possible. How do they know that? Does the Bible tell them so, or the Koran, or do they get it from the Torah? Why not cite the source of their certainty instead of advancing an unsupported proposition. I do not mean to be rude, but excuse me, what scientific proof can they offer for that immovable avowal? There is no scientific proof whatsoever, none at all, except for the words and their steadfast, and maybe self serving, postulate. Accordingly, obviously it is they, not us, who are the ones that have "Nihil Est Demonstrandum," in this matter. There is not one scintilla of sustainable evidence to support such a doctrine. While the vast majority of people knowledgeable about cryptography have not heretofore believed that it is possible for software to produce an OTP, that does not make it a scientific fact, but merely means it is the consensus of scientific opinion that it is not possible. With all due respect to Bruce, and his exceptional work, Paul, Roy and many others who obviously know the subject matter of which we speak, I offer that history is replete with scientists supplying proof of the seemingly impossible. In support of their position, some have pointed out that John von Neumann, to paraphrase, stated that ARITHMETIC cannot produce random numbers, a thesis which I agree with; but where is that, in any way inconsistent with IPG's position on EUREKA? IPG has produced a system to generate software OTPs, albeit it within limited but but more than ample entropy, not software random numbers. We stipulate the obvious fact that the encryptor stream generated by EUREKA is a PRNG stream, though we do consider it gross denigration to castigate it as ONLY a PRNG stream. It is a PRNG issue that also happens to be an extremely well behaved OTP sequence, with limited but ample entropy, as well. It meets each and every criteria rationally established for an OTP in all reasonable aspects. Subjected to any and all statistical analyses, the EUREKA PRNG stream manifests itself as being random, though we know, as a scientific fact, that it is not. To substantiate that posit, and unlike the consensus of scientific opinion, obviously N.E.D., that believes that software cannot produce an OTP, IPG offers "Quod Erat Demonstrandum," Q.E.D. scientific proof that we can produce a humungous number of software OTPs sufficient to meet any and all current or future requirements. You do not need to be an Einstein, a Hawking, or a von Neumann, to understand the fundamental basis of the IPG EUREKA algorithm. Succinctly as I can , that is, given a truly random key of entropy N, and possibly truly random look up tables of combined entropy M, it is possible to generate up to N streams of characters of a length in this case of approximately 10^223, that manifest themselves as true OTPs. Think about that simple supposition for a moment. What do we mean by an OTP? We mean that an OTP is a stream of characters, or numbers, that cannot be derived in the absence of the key that was used to generate them, or alternately by trying all possibilities of that said key. Thus, when using the resultant as an encryptor stream, the only information derivable from the ciphertext is the determination of the maximum possible length. Furthermore, by using the exclusionary proof, you cannot preclude any possible message of that said length. If you think through that hypothesis, it becomes clear that such is not precluded by von Neumann's proffer, or by fundamental mathematical principles. The question then, is how can you go about doing that? That is all that IPG has done. We have figured out a mathematical certain way, ( Q.E.D.), of generating N number, or rather a number very close to N, of OTPs from a given key of entropy N, and we can prove it. Not only that, but you can prove it to yourself, Q.E.D. We maintain that it is discernible to any knowledgeable person who probes the algorithm, that the only analytical tack that can be mounted against EUREKA is brute force and that is patently impossible.. One of your Cpunk colleagues says he uses Triple DES, 168 bits, and he does not believe that it can be brute forced - I agree, 3-DES, 10^50+ possibilities, cannot be brute forced now, or in the foreseeable future - then what about the EUREKA's 10^34322 possibilities, 10^34271+ greater than 3-DES? No way, not now, not ever. Furthermore, EUREKA is an order, or more, magnitude faster than triple DES, easier to use, much more secure, etal. Another has suggested that if the key, and all the variables are hacked, then the system can be compromised. That is true, but again excuse me, does not that apply to any system, whether it be RSA, PGP, IDEA, and yes also a hardware sourced OTP. EUREKA's only edge in that regard is that built in means that facilitate safeguards which minimize such risks. EUREKA is not a panacea for all your encryption needs. RSA, PGP, ENTRUST, and other systems fill very important exigencies. Where EUREKA shines brightest is in two important strategic user applications: 1. To set up a permanent line of Internet/intranet communication privacy between two, or a group of, individuals. As a result, pass phrases, session encryption keys, and other work impediments of that genre can be largely eliminated. While applicable to everyone, this is especially true of newbies, computer novices, technophobes, and other non-techies. It is much faster, easier to use, and more flexible than other systems for this application. As such, it is ideal for intranets, or mixed Internet/intranet systems. 2. To protect your private hard disk files, programs or data, from compromise by hackers and interlopers. In this application it is unsurpassed because differential analysis of changing files is rendered impossible and it is extremely fast. See for yourself. Prove it to yourself, Q.E.D. The IPG algorithm is available at: http://netprivacy.com/algo.html or a condensed version at: http://netprivacy.com/condalgo.html P.S. My resume can also be found there http://www.netprivacy.com/resume.html > ================================================================== > > Donald R. Wood > ipgsales(a)cyberstation.net >==================================================================== > > Some p[eople are more certain of their own opinions than they are of > facts presented by those they disagree with - Aristotle > > ---------------------- Quod Erat Demonstrandum ----------------------

5 4

CyberPromo sparks a new list
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There seems to be some interest, so I've started a list to discuss the CyberPromo ongoing abuse. The list is a simple exploder located at mail-abuse(a)scytale.com. For the present, I'm handling the list manually, so add/delete requests should be sent to me, roy(a)scytale.com. Personal referrals are welcome, but please don't publicize the list generally. - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmWUABvikii9febJAQEPhQQAmMcPvTtAOptXvUbojCXpzWcupniPN+// z6W0/TEBPG5hvA42NiYXOUgvp2ESuKux1uOZfHp5jQb+FnZP6ac38e6mNQ9LxXAA 2iDA3NB2ZopfreIcnAzUt0uzXyQBUaZ1B/LTfyzs6u89nvTqg2cEcUfMm1MI4zDM wGh1KR0kXA4= =RsGr -----END PGP SIGNATURE-----

1 0

Re: Re: SPA's Press Release
by Fred Goldberg 17 Dec '03

17 Dec '03

At 05:10 PM 10/16/96 -0500, Sean Sutherland stood upon his soapbox and declaimed: >Their term, "contributory >infringement" is almost like suing the bartender because a customer got into a >wreck while drunk. Right or wrong, in some states, at least, you can not only sue a professional bartender, you can sue any individual who serves liquor at a private party and allows a guest to drive home under the influence, if the guest causes damage to you or your property as a result. Many people support this "vicarious liability" theory as it relates to drunk driving. Next time, pick a better analogy. You may have just given their lawyers the analogy they need to prove their case. Fred Goldberg WA2BJZ EMT-D

1 0

Q.E.D.
by cypher＠cyberstation.net 17 Dec '03

17 Dec '03

Some of you have sardonically written to say "Nihil Est Demonstrandum," N.E.D. because an OTP must be derived from a hardware source, that is, it must be a pure random sequence of limitless entropy. Accordingly, they unbashfully assert that an OTP generated by a computer program is not possible. How do they know that? Does the Bible tell them so, or the Koran, or do they get it from the Torah? Why not cite the source of their certainty instead of advancing an unsupported proposition. I do not mean to be rude, but excuse me, what scientific proof can they offer for that immovable avowal? There is no scientific proof whatsoever, none at all, except for the words and their steadfast, and maybe self serving, postulate. Accordingly, obviously it is they, not us, who are the ones that have "Nihil Est Demonstrandum," in this matter. There is not one scintilla of sustainable evidence to support such a doctrine. While the vast majority of people knowledgeable about cryptography have not heretofore believed that it is possible for software to produce an OTP, that does not make it a scientific fact, but merely means it is the consensus of scientific opinion that it is not possible. With all due respect to Bruce, and his exceptional work, Paul, Roy and many others who obviously know the subject matter of which we speak, I offer that history is replete with scientists supplying proof of the seemingly impossible. In support of their position, some have pointed out that John von Neumann, to paraphrase, stated that ARITHMETIC cannot produce random numbers, a thesis which I agree with; but where is that, in any way inconsistent with IPG's position on EUREKA? IPG has produced a system to generate software OTPs, albeit it within limited but more than ample entropy, not software random numbers. We stipulate the obvious fact that the encryptor stream generated by EUREKA is a PRNG stream, though we do consider it gross denigration to castigate it as ONLY a PRNG stream. It is a PRNG issue that also happens to be an extremely well behaved OTP sequence, with limited but ample entropy, as well. It meets each and every criteria rationally established for an OTP in all reasonable aspects. Subjected to any and all statistical analyses, the EUREKA PRNG stream manifests itself as being random, though we know, as a scientific fact, that it is not. To substantiate that posit, and unlike the consensus of scientific opinion, obviously N.E.D., that believes that software cannot produce an OTP, IPG offers "Quod Erat Demonstrandum," Q.E.D. scientific proof that we can produce a humungous number of software OTPs sufficient to meet any and all current or future requirements. You do not need to be an Einstein, a Hawking, or a von Neumann, to understand the fundamental basis of the IPG EUREKA algorithm. Succinctly as I can , that is, given a truly random key of entropy N, and possibly truly random look up tables of combined entropy M, it is possible to generate up to N streams of characters of a length in this case of approximately 10^223, that manifest themselves as true OTPs. Think about that simple supposition for a moment. What do we mean by an OTP? We mean that an OTP is a stream of characters, or numbers, that cannot be derived in the absence of the key that was used to generate them, or alternately by trying all possibilities of that said key. Thus, when using the resultant as an encryptor stream, the only information derivable from the ciphertext is the determination of the maximum possible length. Furthermore, by using the exclusionary proof, you cannot preclude any possible message of that said length. If you think through that hypothesis, it becomes clear that such is not precluded by von Neumann's proffer, or by fundamental mathematical principles. The question then, is how can you go about doing that? That is all that IPG has done. We have figured out a mathematical certain way, ( Q.E.D.), of generating N number, or rather a number very close to N, of OTPs from a given key of entropy N, and we can prove it. Not only that, but you can prove it to yourself, Q.E.D. We maintain that it is discernible to any knowledgeable person who probes the algorithm, that the only analytical tack that can be mounted against EUREKA is brute force and that is patently impossible. One of your Cpunk colleagues says he uses Triple DES, 168 bits, and he does not believe that it can be brute forced - I agree, 3-DES, 10^50+ possibilities, cannot be brute forced now, or in the foreseeable future - then what about the EUREKA's 10^34322 possibilities, 10^34271+ greater than 3-DES? No way, not now, not ever. Furthermore, EUREKA is an order, or more, magnitude faster than triple DES, easier to use, much more secure, etal. Another has suggested that if the key, and all the variables are hacked, then the system can be compromised. That is true, but again excuse me, does not that apply to any system, whether it be RSA, PGP, IDEA, and yes also a hardware sourced OTP. EUREKA's only edge in that regard is that built in means that facilitate safeguards which minimize such risks. EUREKA is not a panacea for all your encryption needs. RSA, PGP, ENTRUST, and other systems fill very important exigencies. Where EUREKA shines brightest is in two important strategic user applications: 1. To set up a permanent line of Internet/intranet communication privacy between two, or a group of, individuals. As a result, pass phrases, session encryption keys, and other work impediments of that genre can be largely eliminated. While applicable to everyone, this is especially true of newbies, computer novices, technophobes, and other non-techies. It is much faster, easier to use, and more flexible than other systems for this application. As such, it is ideal for intranets, or mixed Internet/intranet systems. 2. To protect your private hard disk files, programs or data, from compromise by hackers and interlopers. In this application it is unsurpassed because differential analysis of changing files is rendered impossible and it is extremely fast. See for yourself. Prove it to yourself, Q.E.D. The IPG algorithm is available at: http://netprivacy.com/algo.html or a condensed version at: http://netprivacy.com/condalgo.html P.S. My resume can also be found there http://www.netprivacy.com/resume.html P.S. Have any of you received the long: Phoenix arisen from the ashes posting that we made on 10-06-96 weird things are happening. > ================================================================== > > Donald R. Wood > ipgsales(a)cyberstation.net >==================================================================== > > Some people are more certain of their own opinions than they are of > facts presented by those they disagree with - Aristotle > > ---------------------- Quod Erat Demonstrandum ----------------------

2 1