December 2003 - cypherpunks-legacy

Applying ``Crowds'' idea to anonymous e-cash.
by John Kelsey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks, coderpunks, Perry's Crypto List ## Date: 10/09/97 ## Subject: Applying ``Crowds'' idea to anonymous e-cash. ] I was thinking about applying the ``Crowds'' idea to anonymous e-cash, and came up with what I think is a pretty good idea. I am interested in seeing if anyone sees either holes in it, or ways to improve it. I am also interested in hearing about whether or not it has been invented before. Crowds, for those who haven't seen it, is a way of giving web users partial anonymity by making it impossible to determine which member of some ``crowd'' of users did some action (such as requesting a document). (This is a very rough summary--read the paper for the real analysis.) I can see a way to do something very similar with withdrawing electronic coins. (This works best with online-cleared coins), without any blinding being used. I think this gets around the Chaum patents. I also think it can probably be implemented more-or-less on top of the web-anonymizing Crowds stuff, though I may be wrong. Here's the basic idea: 1. A Crowd of users forms up, each wanting to withdraw some reasonably large amount of money, such as $100, in $1 e-coins. 2. Each user provides a public key and pays some money (perhaps $101) into the bank. The bank registers each public key as belonging to a member of the crowd. 3. Each member of the crowd is given all other members' public keys. 4. Each member prepares 100 one-use symmetric encryption keys, each with a 64-bit key ID. 5. The members organize themselves into a sort of one-time anonymous routing network, using those public keys. Each message to be sent is encrypted in layers (a la onion routing), so that each member appears at least once in the message's path. Each message ends up at the bank, eventually. I'll talk about likely network architectures later, if anyone's interested. 6. The bank publishes something noting that it has received N*100 keys, where N = the number of members in the crowd. It also publishes the hashes of all N*100 symmetric keys. 7. Each member digitally signs something saying that he agrees with the keys published, he hasn't been railroaded, etc. Nothing proceeds until this has been published from each member. 8. The bank encrypts one $1 online-cleared e-coin under each symmetric key. It publishes a list of (key ID, encrypted coin) pairs for all the members to receive. 9. Each member walks away with $100 in $1 e-coins. Nobody can prove which member got which coin. No linking of coins is possible. Now, the protocol isn't all *that* important here, but the idea is: We interface with the traceable money world, but grant a sort of weak anonymity for all users in the crowd. Because the coins are online-cleared, they must be deposited immediately. To protect recipient-confidentiality, these can be deposited under a pseudonym account--basically just a one-use public key. The recipient accumulates a bunch of credit under that public key, and then goes through the withdrawal procedure again to get new, weakly anonymous coins, which he can openly deposit without direct traceability. (That is, the bank can still learn that certain coins were spent at the same place, but can't identify the final recipient of the money. I can think of ways to adapt this idea to unlinkability, though they involve some implementation hassles.) Note that multiple iterations of the withdrawal protocol make things much stronger. That is, there is no reason why the participants in the withdrawal protocol have to spend their e-coins directly--they can also use them, along with a one-use public key, to go back into the withdrawal protocol again. An attacker who manages to link a given coin to a given crowd (possible only with the help of the bank) with some anonymous participants (who paid in with coins from this scheme) must face the possibility that this coin could have come from the anonymous participants--which can then be traced to another pool, with other anonymous participants, etc. The attacker can't even make statistical statements in many cases, since, if I were doing something really hot, I'd want to go through the withdrawal process lots of times. The bank can tell only what crowd your coins came from, not how many times you have swapped your coins out. If you're willing to pay the transaction costs and time, you can withdraw and deposit as many times as you like. Comments? Is this idea practical at all? Has someone else already done it? --John Kelsey, jmkelsey(a)plnet.net / kelsey(a)counterpane.com - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAi5JqlEAAAEEAPCEHMBdDCAJ83/ibNM7ngCaaibv7YkTxcpKPjTO+WcjswFV SEzMeTqW4MX2wSKdfcMq1HembbgfYs7v2UCnUFkLPZF19s3yUSISGcS7JxlBc3q1 7uj8W5XfBoGpgCYQqYFL2+AB/+3tLu7lU5iiEYCnevY5GQkq0kHx57Ag8goBAAUR tCdKb2huIE0uIEtlbHNleSBKciA8am1rZWxzZXlAZGVscGhpLmNvbT6JAJUDBRAv 5uh7QfHnsCDyCgEBAQZ2A/9/OMeWK4YC+PnEzBTmgpF4WAOsVXfzRD3zAbzfNWY9 MEGo4gRF8Mr1lPHdK+0JOHp327mj9ZvYqQb1bV5fwc5dJa8/Z34VLPYlVg2rV7vJ Hd0YnrgkoaIerbRmtP8dmZGeygeFtrk8aDCdcnMm27+tTJACl5hv2yjFO9rxBq+R MLQpRXhwaXJlcyBmb3IgbmV3IHNpZ3MvbXNncyBvbiBEZWMgMzEsIDE5OTc= =pOyw - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNDzFQkHx57Ag8goBAQHYkQQA0Oud9OvEX7qJdxJgGyirqzrAN4jI005p aOVl9UnSf4XGEPj1DFMONW61HaLoh46tEDmnfMrXjI706IfwNF3HfY14FIrGe5Nb U386CP5iztc6rpS6YsiX+prN9Q9RIXzari9uSHrmYSlGAcqa571vy7kkn7uejGBC jv+0hnYNE1M= =aHpr -----END PGP SIGNATURE----- --John Kelsey, Counterpane Systems, kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36

2 1

EU Rejects GAK
by John Young 17 Dec '03

17 Dec '03

9 October 1997 Source: The New York Times, October 9, 1997, p. D4 Europeans Reject U.S. Plan On Electronic Cryptography Threats to Privacy and Commerce Are Cited By Edmund L. Andrews Frankfurt, Oct. 8 -- The European Commission has rejected proposals by the United States aimed at insuring that police agencies can crack coded messages over telephone and computer networks. In a lengthy report released today, the European Commission said the American approach could threaten privacy and stifle the growth of electronic commerce and that it might simply be ineffective. The report appears to all but doom efforts by the Clinton Administration and the Federal Bureau of Investigation to establish a global system in which people who use cryptography would have to deposit a "key" for unlocking their codes with an independent outside organization. As envisioned, the police or intelligence agents would be able to use this key once they got court approval to carry out a wiretap. The plan has been vigorously opposed by the computer industry, which fears that it would jeopardize sales to foreign customers. Because of the Internet's borderless nature, American officials have long acknowledged that their plan is workable only if most other countries adopt similar systems. If not, people could simply route their communications through countries with no restrictions. The White House had already run into heavy opposition from civil rights groups, the computer industry and Congressional Republicans. And earlier this year, the United States failed to muster any support for its plan from the Organization for Economic Cooperation and Development, a consortium backed by more than 40 countries. But the European Commission's blunt opposition, reported today in The Wall Street Journal, went considerably further, raising a slew of objections to "key recovery" and "key escrow," systems. Among them were these: + Hackers could find new ways to breach security." Inevitably, any key access scheme introduces additional ways to break into a cryptographic system," the report said. + The systems could weaken European data-privacy laws. "Any regulation hindering the use of encryption products," the report said, "hinders the secure and free flow of personal information." + Even with a "key escrow" or "key recovery" system, criminals cannot be entirely prevented from using strong encryption. More broadly, the European Commission said, any kind of key-based system could jeopardize the rise of electronic commerce. "If citizens and companies have to fear that their communication and transactions are monitored with the help of key access or similar schemes," the report said, "they may prefer remaining in the anonymous off-line world." American officials did not disguise their disappointment, and challenged the Europeans to come up with better alternatives. "I am a little surprised," said William Reinsch, Deputy Secretary of Commerce in charge of export administration. "My question to the European Commission is, where do they think the market is going? Our sense is that corporations engaged in electronic commerce want key recovery in some form, because they want to recover their own records and to monitor their own employees." Beyond high-minded policy issues, European officials quietly acknowledge that they have political and economic concerns. For one thing, several countries do not like the idea of deferring to an American system that might allow American companies to dominate the next generation of security products. The German Government, meanwhile, is worried that American authorities might have improper access to data on German users -- possibly violating Germany's tough new laws on data protection. But the European Union is far from united. Britain has generally sided with the United States in supporting an international system for regulating data encryption. Indeed, the European Commission remained vague about what alternatives to the American system it might actually favor, nor does the report attempt to block member countries from setting up key-based systems if they want to. American computer and software companies greeted the European policy declaration as a victory. "Even the hard-line Governments, the U.S. and the United Kingdom, have said that any cryptography restrictions have to be internationally coordinated because otherwise you can just download material from another country," said Chris Kuner, a lawyer in Frankfurt who represents Netscape Communications and other networking companies in Europe. "This shows that Europe does not agree with the idea of mandatory key recovery. This idea that is the only possible regulatory framework for the world has been clearly rejected." [End]

2 2

Where is _my_ blowjob?
by TruthMonger 17 Dec '03

17 Dec '03

Visited the CNN website earlier. I wasn't at all surprised to see the factual errors and pandering to government spoon feeders for the main sources of many CNN stories. After all, when Captial Hill'$ bottom feeders give away fify billion dollars worth of valuable digital airwave bandwidth, I expect them to ask for a few extras thrown in with the usual bribes and blow-jobs. So it was no great surprise to find CNN still reporting the LIE that the child-rapist/murderer in New Jersey had been a victim of a sexual predator he had met on the InterNet, despite the fact that the news services who *aren't* part of the fifty billion dollar giveaway of taxpayer-citizen's public resources have been reporting the FACTS for quite some time now. Seems the guy bopping the murderer met him on a 1-900 line. Should I hold my breath waiting for the loud calls by reporters and legislators for strict new laws taking away citizens' rights to free speech on the phone systems of America, or would that be dangerous to my health? I know that CNN also has to fill in a few spaces between government spoon-fed mind-control propaganda being fed to the citizens by the recipients of the public largess, so that CNN is forced to throw in a few quickie references to some other websites and information other than that which comes directly out of the assholes of Lying Fuck Freeh and Nazi Cunt Reno, such as: Crime on the Superhighway http://www.geocities.com/CapitolHill/6647/ Investigator Lynn Zwicke However, did somebody on the staff get a blow-job in return for putting a supposed NEWS pointer to this schmuck's ADVERTISEMENT for his or her PI business? I certainly hope that this is the case, since someone should have gotten *something* for opening CNN up to a lawsuit for providing a pointer to an incompetent schmuck who is spreading extremely bad FUD (fear, uncertainty, disinformation) in regard to child abuse and abusers, in order to turn a quick buck. I imagine that CNN has some fine-print disclaimer somewhere, explaining that they are not responsible for the victims of incompetent and perhaps unlicensed schmucks that CNN blesses with their own reputation capital when directing people to supposed news/information sites, but I doubt that the parent of an abused child or a falsely accused child abuse victim is going to be to impressed, nonetheless, with CNN's lack of integrity in not spending the time, effort and expense needed to make certain that they are not throwing their trusting readers into the mouths of waiting hyenas. I'm still waiting for the CNN story which replies to the DoJ and FBI *HANDOUTS* detailing their list of 4,000 suspected pedophiles, with a question as to whether some of the 800 LEA's present at the murder of the religious group in Waco perhaps didn't have some extra time on their hands that might have been better spent investigating all of these alleged pedophiles, rather than pushing and shoving each other to get pictures of burning children. OK, I'm holding my breath, starting........NOW! TruthMonger

3 2

Identical Password and Member ID
by Travel Group Email Account 17 Dec '03

17 Dec '03

Dear Joe, Our records show that your Expedia account contains a member ID and password that are identical. While we understand that this makes it simpler for you to remember them, we are now asking our members to create passwords that do not match their member ID's. We appreciate your assistance in this small change, which increases the security of your account. You can change your password by following these steps: 1. Access your Expedia Member Information http://expedia.msn.com/pub/signup.dll?qscr=uupd 2. Click Continue on the Expedia sign in screen. 3. If prompted, enter current member ID and password, and then click Continue. 4. Click Continue on the secure sign in screen. 5. Follow instructions for section labeled 3 of 6: Password. 6. Click Continue. Thank you for using Expedia. Please feel free to contact us if you have any questions.

1 0

ANY OF YOUR ANSWERS YES?
by BIZ-BEST＠profits.com 17 Dec '03

17 Dec '03

Hello, I read your profile and thought that the following would be of interest to you. You are not on a mailing list so if this does not interest you there is no need to reply. Any of Your Answers Yes? Want to: >Legally slash your business/personal taxes drastically? >Protect any & all assets from any form of judgement? >Learn how to preserve your personal privacy? >Create a 6 figure income in the next 4-6 months? Any of Your Answers No? >Do you know how to make your "nest egg" work 3-5 times harder for you? >Do you know how to set up off shore trusts and protect your owned property from liens & levies? >Can you legally shelter all assets from all Taxes? Find out more and learn how to accomplish all of these by calling: 1-800-497-1799 (24 hr. recorded message)

1 0

Secure Phone: Making man in the middle audible.
by James A. Donald 17 Dec '03

17 Dec '03

Here is a method to render Man in the Middle audible on a telephone connection. Before speech can be encrypted, it is digitized and compressed. It is turned into digital packets. There is some choice in the size and other properties of the digital packets. Suppose that Bob's computer from time to time formulates a plan to do groups of a particular size and form, and sends Ann's computer a hash of that plan and the DH negotiated shared secret. Malloc (the man in the middle) cannot send this hash to Ann's computer for Ann would discover the shared secret she is using is not the same as the shared Bob is using. So his computer must formulate its own plan, and send its own hash, which will not agree with Bob's plan, because Bob's computer does not reveal the plan except by actually sending the packets. So malloc must decompress Bob's speech packets, repacketize them, and recompress them, Often he will not be able to send off a packet, until he has received two of Bob's packets. So this triples the delay, and increases the speech degradation. This should quite noticeable, noticeable enough to provoke Bob and Ann into verifying their connection by reading the hash digits of their shared secret. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: What's really in PGP 5.5?
by Brian B. Riley 17 Dec '03

17 Dec '03

On 10/9/97 12:42 PM, Anonymous (anon(a)anon.efga.org) passed this wisdom: >It still satisfies the government's requirement to get routine >access to most email communications, and to allow criminals who >use standard email packages to be watched. This sums up the stupidity of the whole thing. The *only* thing the government achieves is invasion of honest people's privacy and catching a few stupid crooks who would most likely fuck up anyway and get caught if they are actually stupid enough to think government escrowed encryption is gonna hide their communications. Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "He's mad that trusts in the tameness of a wolf ... or a whore's oath." -- SHAKESPEARE, "King Lear," III, 6

1 0

Re: America as a Shake Down Extortion State
by John Young 17 Dec '03

17 Dec '03

Tim May wrote: >The debate over crypto almost certainly fits this pattern. If and when a >domestic ban on crypto is likely to pass and be signed, companies like RSA >and PGP will face extinction. This will then "incentivize" executives of >these companies to release funds, in the form of campaign >contributions--either directly or through back channels--to the Republican >and Democratic parties. Then a "compromise" will be found which lets RSA >and PGP, as examples, survive. And they may also be given government >business, with suitable GAK features made mandatory. Netscape has just been awarded a major contract with the Department of Defense for "secure" browsers, with options for "annual renewals." One of the best ever for NSCP. This is a public deal, as distinguished from the secret others pointed to in mandatory public notices in the Federal Register of meetings closed for national security by the Defense Science Boards, the National Defense Panel, and a welter of mil/gov advisory groups composed of members from industry, education and policy orgs eager to get advance word of market and contribution opportunities.

1 0

Re: Applying ``Crowds'' idea to anonymous e-cash.
by Anonymous 17 Dec '03

17 Dec '03

Lucky Green wrote: >On Thu, 9 Oct 1997, John Kelsey wrote: >> Crowds, for those who haven't seen it, is a way of giving web users >> partial anonymity by making it impossible to determine which member >> of some ``crowd'' of users did some action (such as requesting a >> document). (This is a very rough summary--read the paper for the >> real analysis.) > >Some people from MSFT proposed a similar concept at FC'97. As for its >real life value, the legal term for such a system is "conspiracy". Almost everything we do could be called "conspiracy". John has a good idea here. Let's give it room to grow.

1 0

export jobs not crypto
by Jim Burnes 17 Dec '03

17 Dec '03

I know this is probably like preaching to the choir, but I remember Freeh recently saying that there were no significant losses of software exportation to foreign software companies. Well he is obviously ignorant or lying through his teeth. I'm about to recommend a software purchase from a foreign software company that might exceed #300k. Is that on Freeh's radar yet? Mind you, I don't care where people get their software, but if Freeh is trying to calm the America Firsters by saying that crypto imports aren't important I think someone is congress ought to be informed. Declan? You're still out there in the pit of vipers. Why don't you tell them. My congressman doesn't seem to listen to me. "How do you explain school to higher intelligence?" Elliot to his brother in ET

3 2