December 2003 - cypherpunks-legacy

PGP3.0 & ElGamal
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

On Fri, 25 Oct 1996 00:32:52 +0100, Adam Back wrote: [snip] > Also I understand, though there appears to be no available > documentation saying as much, that pgp3.0 will not use RSA, nor IDEA, > nor MD5, using instead El Gamal for public key encryption and > signatures, 3DES (unsure?), and SHA1. Can someone confirm that PGP3.0 will use ElGamal? Bert-Jaap

8 10

RE: Remailer Abuse Solutions
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 10:34 AM 11/13/1996, Mullen Patrick wrote: > Sounds like another attempt to raise the cost of using the Net, nothing more. I am curious which conspiracy you believe I am participating in, other than the Great Cypherpunk Conspiracy, that is. Keep in mind that nobody is forced to participate. > Sure, paying postage (Is $1 really necessary? Why email when snailmail's > cheaper??) may reduce general spamming done by local punks, but it does > nothing > against corporations which already spend millions on snailmail spamming. Many people would be happy to read spam mail at $1 a piece. Assuming you can scan at a very conservative 3 messages/minute, that's $180/hr. you can make in the privacy of their own home. Not enough for you? Raise the rate. One dollar is a nice schelling point. That's why I chose it for my example. In practice the people involved are welcome to choose any amount in any currency they like. > Also, > what happens when your long-lost friend comes across your addy and tries to > email you? Surely you don't want to charge postage for an otherwise free > service to him/er. Maintaining a list of "accepted sources" would be a hassle > not many people would accept. Absent highly intrusive global net monitoring techniques, that's what they are going to have to do anyway. E-mail is inexpensive. The advertiser can justify the expense even if generates a small number of leads. Expect more spam. The alternative to filtering the mail in some way is to create Internet licenses for every participant which may be revoked for infractions. These licenses would have to be global. Big Brother is Watching. Advertisers do not have a monopoly on spam. Many people - especially women - complain about harrassing mail they receive. > Slight variation is to generate a list of "toll these entities." A smaller > list > (hopefully :-), and generally easier because then it defaults to no-bill. Or, > to accomodate superstars/actors/etc, generate files like rhosts.accept > rhosts.deny in UNIX. That way, the user may use either/both types of > filtering. How will you construct your "toll these entities" list yet accept mail from any remailer? Why will spammers not figure out remailers? > Again, the average user wouldn't want to deal with this hassle, everyone's > mail > software would have to be rewritten, and I basically oppose any ideas that > cost me money for something I already get for free... :-) No, everybody's mail software would not have to be rewritten. That was the idea. For instance, it would be easy for users of Unix systems to use procmail to pre-filter their mail for whatever program they like. Nota bene: the remailer operator is not offering to filter the users mail. "Free" is not always the best choice. I would gladly pay $10/month to receive the cypherpunks list if it meant that messages were delivered immediately when sent. (I believe these delays hamper the discussion.) As it is, I can't complain because I am a recipient of John Gilmore's charity. I would be interested to hear more about your solution to this problem: People spam other people who don't like spam but like to receive anonymous messages. I would prefer to see solutions in keeping with the Cypherpunks spirit; that is, no use of force, no use of law, and no loss of anonymity will be acceptable. Peter Hendrickson ph(a)netcom.com

2 1

RE: Question on non-repudiation
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 13 Nov 1996 04:11:08 -0500 (EST) X-Sender: field(a)pop.pipeline.com Mime-Version: 1.0 To: John Lowry <jlowry(a)BBN.COM> From: "Richard L. Field" <field(a)pipeline.com> Subject: RE: Question on non-repudiation Cc: set-discuss(a)commerce.net Sender: owner-set-talk(a)commerce.NET Precedence: bulk +----------------------------------------------------+ Addressed to: set-discuss(a)commerce.net +----------------------------------------------------+ As chair of the ABA's Electronic Commerce Payment Committee and a member of the drafting team for its Digital Signature Guidelines, I suppose I am one of the people expected to "solve" the non-repudiation problem through legal means. Notwithstanding any technical or procedural proofs, there is no absolute non-repudiation, as a legal matter, unless a statute is enacted to that effect. For consumers in the U.S., there is no indication that this will happen. The applicable laws governing credit cards and the consumer use of debit cards specify that the customer can repudiate any unauthorized transaction, and that it is left to his bank/issuer to prove that the transaction was actually performed by that customer or under his authority. Even if technical means are used to ensure that the customer will always retain solitary access control to the account (by biometric means, for example), he can still claim coercion, error with respect to legal capacity, etc. Where software-based keys are used to confirm identity and/or authority to enter into a transaction, there are additional risks of error or fraud associated with initially obtaining a key and tying it to an identity, as well as the ongoing association between the key and the identity and/or authority. In these cases some third party ("trusted" CA, etc.) could step in and contractually agree to bear all risk of customer repudiation, but given the relatively low value of the average transaction that would be unlikely. Additionally, in some countries laws may shift the risk of loss absolutely to the customer or otherwise prevent him from repudiating a transaction. To some degree, this is the direction taken in the U.S. laws governing commercial wire transfers. If there are any countries contemplating the enactment of laws that would absolutely bind a person whenever his private key has been used, I would be most interested in hearing about them. - Richard Field At 11:35 AM 11/12/96 -0500, you wrote: >+----------------------------------------------------+ >Addressed to: set-discuss(a)commerce.net >+----------------------------------------------------+ > >Not to be argumentative but non-repudiation can be established >technically. The formal definition requires that through technical >and procedural proofs a party cannot repudiate a transaction. The >law may not recognize those techniques and procedures for contractual >purposes today but the ABA is working on it.... ------------------------------------------------------------------------ This message was sent by set-discuss(a)commerce.net. For a complete listing of available commands, please send mail to 'majordomo(a)commerce.net' with 'help' (no quotations) contained within the body of your message. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: So how does the crypto crackdown go?
by Hal Finney 17 Dec '03

17 Dec '03

From: "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> > As Hal knows, but some newer members of the list may not, I discuss the > possibility of a ban on strong (unescrowed) crypto at some, ahem, length > in > > http://www.law.miami.edu/~froomkin/articles/clipper.htm > > Although the article is more than 18 months old, the law hasn't changed > in any material way as far as I know. > > Bottom line: they probably can't do it under the constitution, but it's a > closer call than it should be. This is a very helpful and thorough analysis. However it does not address the possibility of a ban on the sale/distribution of strong crypto, rather than a ban on its use. There are several reasons why I think the former is more likely: - PRECEDENT FROM ITARS The current bans on export of encryption software limit the distribution of the software itself, not of encrypted messages. Extending this ban to domestic distribution would imply banning distribution but not use of crypto software. - NOT A PRIVACY ISSUE The privacy issues would be much less relevant because it is no longer a matter of just what you do in the privacy of your own home. - OUT OF THEIR OWN MOUTHS The Clinton administration's original veiled warning, quoted in Michael's paper, denied that "every American, as a matter of right, is entitled to an unbreakable commercial encryption product." Noting the use of "commercial" this suggests a ban on sales rather than use. - COMMERCIAL REGULATION Not being a lawyer, I can only speculate that the interstate commerce clause would give more justification for a ban on distribution than on use. - FOOT IN THE DOOR Conceivably such a ban, if successful, would provide new arguments for advancing to the second stage of a ban on usage after some time. The impact of the usage ban would be less due to the lack of access most people would have to such software, and the (arguably) demonstrated effectiveness of the government approved software almost everyone would be using by that time. - BIG BROTHER IS WATCHING We have long speculated that the government's real interest is in making mass surveillance more practical, with the stated concerns about criminals being merely a convenient cover. Commercial restrictions would be consistent with such motives since they would have more impact on the innocent many than the motivated few. A ban on sales and distribution could still be opposed on First Amendment grounds, especially if it becomes established that software is speech. Still there are many restrictions possible on commercial speech so even a favorable precedent in this area would not preclude some regulation of software distribution. We could also argue that such a ban is de facto equivalent to restrictions on use, since most people would not then have access to privacy preserving software. In that case the many excellent arguments which Michael brings forward to oppose such restrictions would be relevant. And what would be the implications for freeware crypto? Could distribution of such software be subject to regulation in the same way as commercial programs? Then there are the issues relating to speech about crypto which are currently being litigated. Presumably domestic restrictions on such speech would have to reach a much higher standard of demonstrated need than restrictions on export. For these reasons I think that domestic regulations on the sales and distribution of strong crypto would not be a sure thing for the government, but would be a lot easier for them than restricting use. This suggests that it is a likely direction for them to take after the next terrorist attack. Hal

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

Re: pgp3 Re: pgp3
by nobody＠replay.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com cc: ktk, prz(a)acm.org, colin, pgp(a)lsd.com Subject: preliminary pgp 3.0 api document Date: Sat, 11 Feb 95 17:30:55 -0800 From: Katy Kislitzin <ktk>

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0