December 2003 - cypherpunks-legacy

Re: "Cryptography Policy and the Information Economy" draft available
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:11 PM 12/19/96 -0500, Matt Blaze wrote: >I've got a new draft available of my critique of US cryptography >policy and its impact on the future of the "information economy". >It summarizes comments I made to a recent meeting of the Computer >and Communications Industry Association, and is an updated version >of testimony I gave to the Senate commerce committee earlier this >year. > >Postscript is at ftp://ftp.research.att.com/dist/mab/policy.ps >ASCII text is at ftp://ftp.research.att.com/dist/mab/policy.txt Matt, I liked your draft except for one thing. You never mentioned that the government has never established a legal right to access the cleartext of an encrypted communication or file. Perhaps the most severe flaw in the GAK proposals is that I as a citizen wish to attempt to keep secrets from the government and to force them to take me to court to get a judge to demand that I release those secrets -=- while their proposals are trying to prevent me from even attempting such. - Carl -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMrn+WlQXJENzYr45AQFrFgQAp2jfB3EOLJoOKHIpTne7D4cwL1KzPcRg VoELRWDGS1RkgK5cSgLl9ASWZ7TdcMRiQUbDPMoffMi3UWlfIpomdsHq+E4HE/U+ 6CS+cpUfw/eSwBYkotCfETMAHymknu/o06QYfBX0TQsN/2XOC52xXEd9Nb/8xjUW c4RETw8Os8A= =nkcy -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +------------------------------------------------------------------+

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:18 PM 12/19/1996, Ben Byer wrote: >> At the last meeting references were made to processors which only >> execute encrypted code. Decryption occurs on chip. >> >> If each chip has a unique public/secret key pair, and executes >> authenticated code only, there are some interesting implications. > Let's see... What about this scenario: > Alice gets a contraband copy of PGP 4.0 off the Internet. Since the > public-key algorithm is publicized so that people can encrypt software > to a chip, PGP 4.0 has the ability to encode/decode/generate keys for > the chip. Alice generates a public key/private key pair 0x12345678, > in software. Alice goes to www.microsoft.com and orders Office '99 > online, and tells Microsoft "Hi, my name is Alice, my credit card > number is 31426436136778 and my PGPentium's public key is 0x12345678." > Microsoft unwittingly sends Alice a copy encrypted to 0x12345678, for > which she has the private key to. Alice decrypts Office '99, and > reencrypts it with public key of her PGPentium, as well as the keys f > all her friends. The software vendor would be wise to check that the public key was legal. It would be a simple matter for the manufacturer to publicize all public keys that had been installed on chips. > Does the authentication defeat this? I'm sort of waving my hands around when I say "authentication". One approach is for the manufacturer to authenticate software submitted by approved vendors. The vendors are then tasked with encrypting it for the correct processor. > Our computers would only run software from Microsoft? Scary. There are all sorts of nifty deals that could be made. Microsoft could commission a special run of the processors which only run Microsoft approved software. Machines using these processors could be given away or sold at a steep discount. You could also timestamp the software so that it only runs for a given length of time. This will encourage people to upgrade regularly. ;-) The processors could also support metering. The processor could support some sort of API for the software to tell it how many computrons had been used and stop it from running after they run out. This means that light users or evaluators of software pay relatively low prices while heavy users pay high prices. This is a great deal for all concerned. Right now software vendors try to do this with clever deals, but it's crude at best. Peter Hendrickson ph(a)netcom.com

4 3

Re: Credentials without Identity--Race Bits
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:38 PM 12/11/96 -0800, "Timothy C. May" <tcmay(a)got.net> wrote: >Consider a "race credential" offered by some entity. .. >(Why some groups might want this is left as an exercise for the reader. >Perhaps a less-inflammatory example (to some of the sensitive amongst you) >might be that some women want to interact in "women only" forums--a clear >case of discrimination, no?--and may want a "gender bit" avaiable to >display as a credential.) I've already tried to subscribe to a forum (at the liberal Utne reader!) where I was rejected because they currently had more subscribers who identified themselves as "male" than as "female", and they wanted to maintain a balance. And certainly "US Citizens Only" sites are common - nationalism is just as ugly and stupid as racism, and far more likely to be enforced with ID requirements; I've heard that in less civilized parts of the world you're actually required to carry government-issued ID cards to walk down the street or fly on airplanes. Another problem is that "nationalist credentials" made hide other data, such as a race bit, a Jewish bit, a don't-ask-out-loud-don't-tell bit, a suspected-Commie bit, a check-FBI-files-first bit, etc. The subliminal channels in DSS are the best known method for doing this, but it's probably possible to do something similar even using blind signatures, especially if there are multiple keys or timestamp fields. For example, they could use different signature keys that are supposedly just "signed at the New York/LA/Langley/Holtsville/SF/DC office" or "signed 4/1/97 4:20pm". # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

11 12

Re: Executing Encrypted Code
by Jazzmin Belle Sommers 17 Dec '03

17 Dec '03

>>>> You could also timestamp the software so that it only runs for a given >>>> length of time. This will encourage people to upgrade regularly. ;-) >>> Or to reset their clocks. Which is what many of us do when software is >>> about to "expire." >>However, why not use "beacons"? chop chop chop I have been using some shareware that simply has a built-in counter. Once the counter runs out, you have to register. I would suppose that one could hack the code to find the counter, assuming you could decompile it (or wanted to). Personally I think this is a decent solution to the problem -- the counter on this particular software let you use it 50 times. That's adequate to determine whether you want to keep it or not. Of course, if you saved the .zip file to disk before you installed it, you could delete the copy and reinstall the .zip. But everyone knows this. Jazzmin Sommers

1 0

RE: Securing ActiveX.
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Armenians are murderous cowards. They killed over 2 million Moslems in > this century alone - mostly women and children. I note that along with this racist generalisation you decided to post the following rant: >As usual, Timmy May spouts racist, anti-Semitic shit. As usual, he has >no idea what he's talking about. So what else is new... As well as a number of other rants along those lines. There is little difference between over generalisations of the kind you made above and, for example, discriminating against someone on the basis of race, colour, religion etc. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 8:31 PM 12/19/1996, Timothy C. May wrote: >At 7:34 PM -0800 12/19/96, Peter Hendrickson wrote: >> You could also timestamp the software so that it only runs for a given >> length of time. This will encourage people to upgrade regularly. ;-) > Or to reset their clocks. Which is what many of us do when software is > about to "expire." You are right that this only works in instances where the customer just needs a little prodding to get the upgrade and not in instances where the customer might put up with significant inconvenience to avoid it. However, why not use "beacons"? The clock could have a built-in timer that needs to be reset once a month from an authenticated source. This assumes the presence of net connectivity, but that's not a terrible assumption. Peter Hendrickson ph(a)netcom.com

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:16 PM 12/19/1996, Ben Byer wrote: > The manufacturer is going to publish a list of ALL of the public keys? > We're talking one key per chip, right? Isn't that an AWFUL lot of > keys, like, in the millions range? Let's say each key is 2048 bits and there are 10 million processors. That's only 2.38 gigabytes, or under $1000. Easy enough to put on the Web or on a set of CD-ROMs. > Also... with a few million possible keys like this, all you need to do > is to either guess or factor just one of them. Yes, my working assumption is that factoring is very hard. >>> Does the authentication defeat this? >> I'm sort of waving my hands around when I say "authentication". >> One approach is for the manufacturer to authenticate software submitted >> by approved vendors. The vendors are then tasked with encrypting it >> for the correct processor. > I'm not sure the "approved" bit would go over too well... one idea > would be to license the compiler writers, who would build the > encryption into compilers. It's still not horribly great, but > better. You have to have the "approved" message so that you don't get viruses and to thwart piracy in case anybody did manage to get the secret key out of the chip. How well it goes over depends entirely on how much you pay for the software. >>> Our computers would only run software from Microsoft? Scary. >> There are all sorts of nifty deals that could be made. Microsoft >> could commission a special run of the processors which only run >> Microsoft approved software. Machines using these processors could >> be given away or sold at a steep discount. > Right; the only reason I could see people using this would be for > economical reasons. And one would expect piracy-proof software to be very inexpensive. Most people who pay for software have little sympathy for those who don't. >> You could also timestamp the software so that it only runs for a given >> length of time. This will encourage people to upgrade regularly. ;-) >> The processors could also support metering. > Right; once the user loses control of what he's running, then you can > pretty much do anything you want as far as metering goes. Right you are - see below. > ObGAK question: Would this be exportable? I mean, you could be > encrypting god knows WHAT into those .exe's... Key escrow? How would > they get the key?!? I can see the headlines, "Key Escrow Database > Leaked to Pirate Firm"... :) While I am certainly not a lawyer, and even the lawyers can't tell you what is legal to export, I would guess that Big Brother would be delighted with the manufacturers of this processor. It can't be used to encrypt communications, only to decrypt software. What is more, you could control the physical processors so that exportable processors accept a different authentication key. Then, the manufacturer of the processor can take care not to authenticate any privacy enhancing programs for the export version of the processor. Free speech and constitutional issues evaporate because the processors are physical devices and not expressions of ideas. Even "better", not very many organizations in the world can afford the fab lines to manufacture a state of the art processor. So, if the G-7 countries are brought onto the reservation, it would be feasible to forbid all free processors. Peter Hendrickson ph(a)netcom.com P.S. Did you hear? For Christmas Big Brother is raising the chocolate ration from 30g to 20g!!!

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:20 PM 12/19/1996, Timothy C. May wrote: >> However, why not use "beacons"? The clock could have a built-in timer >> that needs to be reset once a month from an authenticated source. This >> assumes the presence of net connectivity, but that's not a terrible >> assumption. > I mentioned "beacons" in the portion of my message you did not quote here. Gack! > As for why they are not being used, they don't exist. Here's how I would do it. When the processor wants to update its clock, it generates a random number and encrypts it for the trusted time source. The trusted time source decrypts its message to get the random number. It timestamps it, encrypts it, and sends it back. This means you can't replay old time messages to keep using your old software. Is it possible to have a little clock and rechargeable battery on a chip? If so, then this technique should be easy to use. If not, then the processor can count the number of cycles it runs and use that as an approximate means of deciding when to check the time. Or, it could demand a time update every time it is power cycled. Peter Hendrickson ph(a)netcom.com

1 0

Expedia New Member Information
by accthelp＠expedia.com 17 Dec '03

17 Dec '03

Welcome to Microsoft Expedia Travel Services! Below is your new membership information. Please keep this confirmation mail as a record of your Member ID and Password. Your Member ID is: cypherpunks Your Password is: cypherpunks The Expedia Internet address is: http://expedia.msn.com/ Expedia is a free service. To use the Expedia Travel Agent, you will have to type your Member ID and Password on the Sign In page. Whether for business or pleasure, Microsoft Expedia makes it easy for you to plan and purchase travel arrangements that best meet your budget and personal preferences. Expedia is on the job 24 hours a day, 7 days a week. With a click of your mouse, you can: * Reserve and purchase airline tickets * Reserve hotel rooms * Reserve rental cars * Subscribe to Fare Tracker for the lowest airfares to your favorite destinations * Research over 300 destinations in the Expedia World Guide * Chart your course with over 200 city maps * Check out the world of adventure in the Mungo Park online magazine * Catch up on the latest travel news, weather and more We look forward to fulfilling all of your travel needs. Expedia Member Services Start your travel here. http://expedia.msn.com/

1 0

Re: Proof that "cypher punks" have complete degenerated...
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 19 Dec 1996 04:24:14 +0000, geeman(a)best.com wrote: >It wasn't worth commenting on. >Appending data after the ctrl-Z as stego? >Not even worth a letter to the ed! >> No one even commented on the latest Dr. Dobbs issue. I know - I was amazed that made it into the issue. It's almost amazing that someone would go to such effort to do this and miss all the [IMHO] easier ways. Simply astounding... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0