December 2003 - cypherpunks-legacy

[NOISE] aga isn't on cypherpunks... (and I'm glad)
by Tim Scanlon 17 Dec '03

17 Dec '03

all, "aga(a)dhp.com", that 'aga' guy, is NOT subscribed to cypherpunks. What has and is going on is that he was blindly Cc'ing cypherpunks on everything he wrote that had to do with this... I exchanged some mail with the guy, he didn't understand AT ALL that "cypherpunks(a)toad.com" was a mailing list address. He seemed to think that he had to be "subscribed" to the list in order for any traffic to goto it. When I pointed out to him that this was not the case, his attitude was that it was not his fault and that the list was "broken" etc. If you havn't figured it out, BELIVE ME, talking to this guy is a definative waste of packets. He's ranting with basicly no clue about how he's doing the ranting... And this stuff has now been cross-posted to about 6 newsgroups by him, in addtion to the 3 mailing lists he's been sending it to. I ended up asking him why he wasn't jsut cutting to the chase and posting "Make Money Fast" stuff instead. (he didn't seem to get it.) I'd suggest ignoring him & hoping he goes away. As it is it was a MAJOR mistake of mine to even attempt to interject sanity into the whole stupid thread on this... Why? Because there's better things to worry about in life. Like this H/P crypto announcment... Or anything crypto related for that matter. As it is the thread continues like some bad crack-addled version of the energizer bunny. Tim PS, I just realized my dog does better at staying focused on doing tricks that this list does on staying focused on crypto... That's a bit scary.

3 2

Re: THAT is what makes John Gilmore an ASSHOLE!
by Dr. Jai Maharaj 17 Dec '03

17 Dec '03

>> time for the alt.asshole.john-gilmore newsgroup > An excellent idea, Dr. Grubor! Shall we newgroup > alt.flame.john-gilmore or alt.bonehead.john-gilmore > or both? In that case, can Gilmore's inclusion in the NetScum site at http://www.mindspring.com/~netscum be far behind? Jai Maharaj %:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:% Om Shanti %:%:%

1 0

More Euro Key Escrow
by Ben Laurie 17 Dec '03

17 Dec '03

I've looked more closely at the "Royal Holloway" protocol, supposedly under consideration by the EC for key escrow in Europe, though I must say that anyone who deploys it will get what they deserve. I have discovered some further weaknesses in the protocol, documented at: http://www.algroup.co.uk/crypto/rh.html Comments are welcome. Cheers, Ben. -- Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk Freelance Consultant and Fax: +44 (181) 994 6472 Technical Director URL: http://www.algroup.co.uk/Apache-SSL A.L. Digital Ltd, Apache Group member (http://www.apache.org) London, England. Apache-SSL author

2 1

Don't Feed the Animals!
by Timothy C. May 17 Dec '03

17 Dec '03

Fact is, I now have more people in my Eudora filter file that at any time in the four years this list has existed. Also a fact, there are more people on this list that at any time in history (despite what some of the New Wave journalists are writing about "the death of the Cypherpunks list"). Fact is, the attention being given to Vulis, Aga, Stathis, Boursy, and other list disruptors (or clueless cross-posters) is _exactly_ what they thrive on: controversy. Being the center of so much attention strokes their egos. I suspect John Gilmore made a tactical error in kicking Vulis off the list, as there are so _many_ workarounds. Vulis is clearly posting more messages, of even greater vitriol, than ever before. Dozens of messages just so far today. And his supporters and detractors are chiming in with equally juvenile taunts. This "aga" personna, for example, seems dead-set on doing whatever he can to get himself added to the "Unwelcome on Cypherpunks" list. A predictable effect, I'm afraid. Not that I question John's right to do as he pleases with his machines. This list is, after all, operated at his expense on his hardware. [A minor note, though. I disagree with the abstract notion that John "created" the list, and now "owns" the list. Eric Hughes, Hugh Daniel, and I proposed a mailing list after the first Cypherpunks meeting, and Hugh set it up. John volunteered his machine, toad, as he has volunteered it for so many other projects in the past. While John is in an important sense free to discontinue his hosting of the list, it is also true that traditional notions of "ownership" are not the full story. For example, if the San Francisco Marriot Hotel plays host to the CFP Conference, in any sense is it proper to say they "own" the conference? If a church volunteers space for a club meeting, do they "own" the club? However, in both cases the host may kick out an especially uncouth or disruptive attendee, modulo specific contract language agreed to by the parties, and this is, I think, all John has claimed to be doing with Vulis. Perhaps a mistake, but certainly within reason. I think John has taken a hands-off attitude toward the list, and has never imposed restrictions on topic, membership, etc. This one case involving Vulis was well-described by John: he asked Vulis to stop sending 50K byte rants about the Armenians and Turks to the list--consider that 50KB x 1500 destinations = 75 MB of outgoing traffic, modulo corrections for aliases, compression, etc. Vulis responded with more insults, basically saying "Make me!!!!" Gilmore said, "OK."] And the issue is not just killfiles and filters. It's a matter of not giving the juvenile disruptors the results they crave. Yes, this message is itself likely to trigger at least a couple of "More lies from Timmy [fart] May" spews from Vulis, and a couple of incoherent rants from newcomers Stathis and Aga. I've been saying little on this issue, compared to dozens of Vulis rants every day (ironic that he calls _me_ the main ranter!), but it's time to remind folks of a basic Net maxim: DON'T FEED THE ANIMALS. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 5

Re: Members of Parliament Problem
by Hal Finney 17 Dec '03

17 Dec '03

From: paul(a)fatmans.demon.co.uk > You could also have an arbitrated blind signature protocol whereby > trent shares a keypair with all users. bob encrypts his comment, M > with the key he shares with trent. On recieving it trent carries out > a blind signature on it and publishes it, as trent knows only bob has > the shared key, K he knows bob said M but as it is a blind sigature > and he is likely to be signing a lot of messages (trent is of course > a computer program) he doesn`t know which message came from bob. I don't quite follow how this would work. If Trent issues a blind signature, then that means (doesn't it?) that he doesn't see what he is signing. So how can he confirm that the message is actually from a member of the group when he doesn't see it? > Also Chaums group signatures could be used but unfortunately the > arbitrator can find out who said what, but does not normally know. > Also trent can forge digital signatures with this protocol. > Chaum further mentions protocols for this sort of thing that do not > even need an arbitrator but I don`t have the papers on this. Not all of Chaum's proposals in the original paper from Eurocrypt 91 have this property. Here is what he has, somewhat simplified. Z is the trusted party for those protocols which use one. 1) Each group member makes up a key which he will use for one signature. Z signs each key to certify that it is a member of the group. People don't re-use keys so that messages are unlinkable. Z can tell who sent which message since he knows the keys. 2) Z publishes an RSA modulus N, gives each group member a secret exponent si, and publishes v = the product of all the si. Members sign message m by producing m**si mod N. Then to confirm the signature they engage in a zero knowledge protocol to prove that the signature is of the proper form and that si divides v (without revealing si). Chaum gives a protocol for this. 3) Z again publishes an RSA modulus N, and each group member chooses his own RSA modulus Ni = pi * qi. To sign message m he produces m**pi mod N. He then proves in zero knowledge that the signature is of the proper form and that pi divides the product of all the Ni (without revealing pi). This is the same zero knowledge protocol as in (2) above. 4) Members agree on a large public prime p with generator g. Each member chooses a secret exponent si with public key ki = g**si mod p. (This is a standard discrete log cryptosystem setup.) To sign message m he produces m**si mod p. He must then prove in zero knowledge that the signature is of the proper form and that si is the private exponent corresponding to the public key of some group member, without revealing exactly which group member it is for. The protocol for this is not very efficient. It uses a cut and choose concept and has to be iterated multiple times. In methods 1, 2, and 3, Z can tell who made a signature. In method 2, Z can forge signatures for other members. Method 4 doesn't use a trusted party. Method number 4 is very similar to Chaum's original proposal for undeniable signatures, although the zero knowledge proof is very different since he doesn't want to reveal which particular key his exponent corresponds to. In the Eurocrypt 94 paper by Chen and Pederson they show a very nice protocol for proving that you know the exponent corresponding to one of a set of Diffie Hellman public keys. This is similar to the problem in (4) above. Given k1=g**s1, k2=g**s2, ..., you can prove that you know one of the si without revealing which one. The protocol is pretty simple and just requires one challenge and response, although the amount of data sent is proportional to the number of ki in the set. This could be used to prove group membership anonymously. If there were a list published of public keys of people on the cypherpunks list, you could prove you were on that list without revealing your identity. I think it could be made a signature protocol by having the challenge c depend on a hash of the message. But the authors don't do it that way, they do a more complicated protocol because they are seeking to achieve unconditional rather than cryptographic anonymity. Hal

2 1

Re: Remailer Abuse Solutions
by Hal Finney 17 Dec '03

17 Dec '03

From: Bryan Reece <reece(a)taz.nceye.net> > But what about Okamoto and Ohta's digital cash scheme published in > Crypto '91? It appears to be fully untraceable and transferable. Of > course, I haven't heard of anyone trying to use this scheme (has it > been broken?) This digital cash scheme has a big disadvantage which the authors try to play down. The problem is that all spending by a particular user is linkable. It can't be connected to his True Name but all of it is linked, in effect, to his nym. This is bad because it allows profiling and dossiers to be built up about nyms with interesting spending patterns, which could then be used to identify which ones should be candidates for intensive efforts to discover their identity. Most other digital cash schemes don't allow linkability of the payor's activities, which is a much better approach. Hal

1 0

Re: San Jose Mercury News declares encryption battle over
by Hal Finney 17 Dec '03

17 Dec '03

>From the article <URL:http://www.sjmercury.com/business/compute/encrypt1115.htm>: > Under the plan computer makers could equip their machines, including > personal computers, with electronic ''locks'' of almost any strength. A > single computer model with strong built-in encryption could legally be > sold in both domestic and foreign markets. > > The key is that the encryption circuitry would be inactive in exported > machines, unless both buyer and seller obtained all legally required > licenses to turn it on. > > Domestic customers, and export buyers with a license, would get a special > key card to turn on the encryption, according to HP. Manufacturers would > thus be relieved of the burden of making different computers for export > than for domestic use. So it sounds like the idea is to build crypto around card tokens. I think HP has been pushing this for some time. The question is, will this somehow become the only way to get access to crypto? Unlike the earlier IBM/CIA announcement, this time Netscape and Microsoft have apparently been brought on board. That is a lot worse because these companies are where most people are going to get their crypto in the future. If they have open standards, we can make good crypto available. But if this announcement signals some kind of closing of the system so that only hardware tokens will be used, it could become a lot harder to make strong crypto available. There are also the economic questions about how much these key cards are going to cost, and whether they are going to be routinely supplied with computers or an extra cost item that consumers have to go out and buy. If the latter, a lot of people won't bother, and we'll just have that much larger a barrier to widespread use of crypto. It is certainly very disturbing to see these new moves. Obviously a great deal of behind the scenes negotiations and pressure has been occuring. You have to wonder why Netscape, for example, would forego the opportunity to differentiate themselves from rival Microsoft by positioning their product as the one which refuses to bow to government pressure on crypto. It's also not clear what the hardware manufacturers get out of this. Their sales overseas have never been blocked. There has been no demand for custom crypto hardware. I don't see how they have been harmed by an inability to ship computers with built-in encryption hardware. Granted there are some possible applications for such systems but I don't see the market demand which would drive this decision. Hal

7 7

PGP acquires PrivNet
by Hal Finney 17 Dec '03

17 Dec '03

The company I work for, PGP, Inc., announced yesterday that it had bought PrivNet, makers of Internet Fast Forward cookie-blocking software. More info is on the PGP web site at http://www.pgp.com/. Personally I have a passionate and irrational hatred of cookies so I am very glad to see this move! I can accept them if I'm browsing through an online store and they're being used to keep track of what I've bought, but so many sites these days are just snoopy as far as I can tell. Down with cookies! Hal

1 0

Re: Giving Kill Files a Workout...
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:48 AM 11/16/96 -0800, Dale Thorn wrote: >Alan Olsen wrote: >> What a week! What is this? "Net Loon pig-pile on Cypherpunks day?" >> So far i have killfiled three people in the past two days. (That is the >> total number I filtered to trash before that date.) >> For those of you who are sick of wading through this mess, I am willing to >> show you what it will take to filter those of your choice to /dev/null or >> its local equivelent. (procmail can be your friend!) > >Thank you in advance for your filtering instructions (yawn). > >BTW, why would anyone give a shit whether you killfiled anyone or not? The point is not who or what I care to killfile. The idea is that it can be done by most people without a whole lot of hastle. There are a number of people who do not have experience in setting up procmail. I am offering to help them out in the hope that it will strain out some of the resultant noise from these "Freedom Knight" loons. (Or at least keep a number of people from dropping the list from the bogosity.) I suspect I am in a number of killfiles already... --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Validating SSNs
by Duncan Frissell 17 Dec '03

17 Dec '03

>Timothy C. May wrote: >> >> Indeed, I protected my privacy decades ago by discarding my issued SSN >> and substituting a different one. This "phony SSN" is what I use on my >> tax returns, my credit cards, and for my employers. >> >> Ha! None of them know that this is not my True Social Security Number! >> >> By this I protect my privacy. "The Iliad" and "The Odyssey" were not written by Homer but by another Greek of the same name. Old joke. Might I suggest though that you use varying SS numbers and varying names, addresses, and Dates of Birth so that you deny The Great Enemy a Key_field in the database of life. DCF

1 0