April 2003 - cypherpunks-legacy

Fwd: [Asrg] A New Plan for No Spam / Velocity Indicator
by Fearghas McKay 26 Apr '03

26 Apr '03

--- begin forwarded text

1 0

Fwd: [Asrg] A New Plan for No Spam / Velocity Indicator
by Fearghas McKay 26 Apr '03

26 Apr '03

--- begin forwarded text

1 0

Re: Thanks for the living hell, and question about OpenSSL
by Patrick Chkoreff 26 Apr '03

26 Apr '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Major Variola (ret) wrote: > At 02:20 PM 4/25/03 -0400, someone claiming to be Patrick Chkoreff > wrote: (-: The sig is valid for the key at http://fexl.com/keys/patrick.txt) > I was mistakenly thinking that because my sacred code did not >> in fact record any IP-based transmission logs, users were safe as far >> as anonymity and privacy were concerned. What I missed was that if >> someone put a gun to my head > > Generally in security analysis you want to list threat models and how > you resist (or not) them. > From this you can derive a spec. ... > This leads to the conclusion that security is economics + physics. The > goal is > to make attacks more expensive to your adversary, at "reasonable" cost > to you. > > Subpeonas are cheap to some. True. From the thrashing I took yesterday, I conclude that subpoenas and other forceful means of system compromise are very cheap indeed. That assumes the system is big enough to matter to the bad guys, which is definitely false at initial rollout but from the looks of this crowd is likely to remain false forever if the system cannot guarantee protection against that threat. Everybody here wants an improvement over book-entry systems, but nobody will settle for anything less than fully blinded digital notes. The question of whether digital notes can circulate in the wild without server contact but with the ability to identify double-spenders later is up for grabs. Hettinga likes that feature for intrinsic reasons having nothing to do with network reliability or ubiquity. I find it a bit appealing myself because it can help support small social nets of accountability. I have not reviewed the math in detail, but am I to understand that under this protocol ONLY double-spenders can be identified? That is, if you do not double-spend can you be guaranteed anonymity from other recipients down the spend chain? Obviously those in the know share a common threat model that demands blinding. Certainly that has serious implications for the server. In a non-blinded system you can just store a small number of unspent coins and the server can do tricks like include an lseek number in the coin data to make lookup extremely fast. But nobody wants an non-blinded system. Consequently, the server must store a large number of spent coins and because coin identifiers are created randomly out in the wild there is no convenient embedded lseek number. But yes, it is extremely cool that you can get the bank's signature on X without actually revealing X to the bank. Certainly there are more detailed threats than forced compromise to consider. Some precautions you take just because you can -- lock and randomize memory for example. But whether you turn on internal churning mechanisms to prevent timing attacks, put ceramic caps on memory components, put boxes in Faraday cages, etc. is another story altogether. - -- Patrick http://fexl.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPqmwOVA7g7bodUwLEQIW2QCgqNLLeEA/PbOe3dgazARsXvEJJVoAoLYi nPzuhTdEBoXQs0BJ8ysLz92c =E5lc -----END PGP SIGNATURE-----

3 3

Re: Quarantines may be justified [Santorum]
by Major Variola (ret) 26 Apr '03

26 Apr '03

At 04:30 PM 4/23/03 -0700, Tim May wrote: >The Schelling point for such rights was agreed-upon a couple of >centuries ago with the protection of property rights. My house, my >rules. Your house, your rules. "If the Supreme Court says that you have the right to consensual (gay) sex within your home, then you have the right to bigamy, you have the right to polygamy, you have the right to incest, you have the right to adultery. You have the right to anything." -Senator Rick "Felch" Santorum You'd almost think Santorum understands freedom, wouldn't you? Albeit he should have expanded, "anything that doesn't consensually harm others". (E.g., voluntary masochism is moral.) [Adultery is a violation of a monogamy contract if that's what you've signed; a mere civil matter, yawn. Certainly marriage needn't be monogamous unless you enter a voluntary contract to that effect. Incest is questionable if the state has an interest in future citizens, however its definition (except in immediate family) is cultural. Einstein married his cousin. And of course, all kinds of known-mutants (folks with mental illness, folks with inherited physical problems, congressvermin) are allowed to breed freely --even subsidized to do so. So the State's argument that monogamy is required for *responsible* raising of offspring does not hold water. In fact, historically, bastards had no obligations from their father or mother; then their mothers became obligated; then their father too. Didn't stop Jesse Jackson's father from illigitimately siring him, didn't stop Jesse from siring his own bastard.] But, Santorum needs to be tried & hung for what he meant.

3 2

Metaswitch cleared by FBI for spying
by Tyler Durden 26 Apr '03

26 Apr '03

Interesting. I'll have to read that J-STD-025A. -TD ALAMEDA, Calif. -- MetaSwitch, supplier of the VP3500, the industry's first true Next Generation Class 5 Switch, announced today that it has completed an extensive review with the FBI, which demonstrates that the MetaSwitch CALEA specification meets the J-STD-025A standard for circuit switching equipment. CALEA, the Communications Assistance for Law Enforcement Act, requires that U.S. carriers provide Law Enforcement Agencies (LEAs) with the continued ability to perform electronic surveillance with existing and new telecommunications switching equipment. Electronic surveillance consists of either the interception of call content (commonly referred to as wiretaps) and/or the interception of call-identifying information (commonly referred to as dialed-number extraction). "We simplified providing CALEA compliance for our customers by incorporating CALEA functionality on-board the MetaSwitch VP3500 rather than requiring additional external equipment", said John Lazar, Vice President of Sales and Marketing. "We are ensuring the completeness of our solution with ongoing testing with the FBI." In light of the current uncertainty in world events, electronic surveillance is becoming increasingly important as a tool for law enforcement agencies. Therefore it is vital that vendors and telecommunications carriers develop and deploy solutions that support electronic surveillance, in both traditional TDM and next generation packet-based networks. Technical requirements or standards for CALEA capabilities have been established for several categories of telecommunications by industry associations or standard-setting organizations, in consultation with representatives of the law enforcement community. The Telecommunications Industry Association (TIA) and Committee T1, standards organizations, are currently working on a further revision, J-STD-025B to cover packet based networks. Metaswitch _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail

11 14

CrypTool
by Birger Tödtmann 26 Apr '03

26 Apr '03

Hello, yesterday I attended a presentation about a software teaching people crypto. It's free, so I tested it a bit, and it's seemingly nice and fit to help students understand what good crypto is and what's not. It was invented by a guy working at Deutsche Bank who was horrified about the companies programmers coding new security schemes into the banks software packages on the fly without knowing a bit about crypto and underlying mathematics. The software since then has been shifted to a group at University of Darmstadt which is developing it right now. The software is available for W32 only (*sigh*) but in English as well as German: http://www.cryptool.com At the presentation they said that next steps in development will be new demonstrators ("how does TLS work") on the content side and on the organisational side the port to Unix. With that they hope they can get it Open Sourced. The software is intended for educational purposes, so right now they limited the key space for most algorithms to 20 bit. Well, until the source is released I guess.... ;-) Regards, Birger

1 0

Re: Authenticating Meat
by Patrick Chkoreff 25 Apr '03

25 Apr '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Major Variola (ret) wrote: > I didn't doubt that it was. However, my caveat > remains true, and you haven't proved anything additional. Let me know when you're in the Jasper, Georgia area and we'll have a few beers. :-) > An entity claiming that name, and claiming to be > not-a-bot, and apparently controlling the DNS entry > at the server I checked today for fexl.com today, > has signed a message. Yep, I believe [1] that. That about sums up my digital identity, yes. The real Patrick is tied up in the cellar and I forced him to tell me his password. As the de Vere and Marlowe scholars might say, the works of Shakespeare were not written by Shakespeare, but by somebody else using that name. Not to compare myself with Shakespeare. All too often my words are full of sound and fury, signifying nothing. Like now. > I'm not picking on you. Neither am I trying to be a dick; > skeptical socratics sometimes appear so. Check the archives > for extended discussion as to what, exactly, signing proves. Will do, thanks. I have plenty of reading ahead of me. > On the other hand, *whatever* entity has been signing > these messages collects the reputations associated with > them *more reliably*[1] than merely posting under your > name. ... Well said. I find it utterly amazing that mere sequences of bits can accomplish this. > Maybe you're a 14 year old girl pretending to > be an FBI agent pretending to be a cryptographer :-) Oh God, so it's that obvious? I'm devastated. > Making the leap from key-holder to meatspace > entity is unsound unless something in meatspace demonstrates > it. All this talk about meatspace suggests we should have some spare ribs with those beers. Of course, writing style and personality can help expose private key hijacking and impersonation somewhat, though even that can be counterfeited. I can recognize a post by JP May with my eyes squinted, just looking at the shapes of the letters and paragraphs. But I bet I could do an utterly, mind-bogglingly good impersonation if I tried. > You're all bits from here. BE the bits. - -- Patrick http://fexl.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPqn7ilA7g7bodUwLEQIOBACg3TZd5QDrTRZrAfbQp5mL3zOmCSMAmweL SAuFYI7/FFp5ykM+uteVkrsZ =kNeU -----END PGP SIGNATURE-----

1 0

Re: Thanks for the living hell, and question about OpenSSL
by Patrick Chkoreff 25 Apr '03

25 Apr '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Tim May wrote: >> I'm writing "(unblind (sign (blind X))) = (sign X)" on the board one >> hundred times. > > You don't need to take our word for it--you need to see why modern > cryptography avoids trust issues almost completely. No no, I'm not writing it out of blind obeisance. I actually see how and why blinding achieves anonymity and avoids the trust issue. When someone presents a note for redemption, the server literally has no way of knowing to whom that note was originally issued. All it knows, and all it can *possibly* know, is that it is a valid note that has not been redeemed. In the previous scheme I was simply not aware of this design goal. I did not even view my system as implying a promise not to look. I simply viewed it as a system that does not in fact look. But I see now why that's a problem, because (1) a system that does not look now can start looking tomorrow and (2) users have no way of knowing either way. So the promise of which you speak is in fact implied, as I know today after my cypher-hangover this morning. Nothing a four mile walk with the dog couldn't cure. > I suggest that you dig up Chaum's "Communications of the ACM" paper > from 1985: "Transaction Systems to Make Big Brother Obsolete." I read > it when it came out, and it triggered many ideas. It's online, or was > as of a few years ago. That's funny, it was a 1989 CACM article by J. Steensgaard-Madsen that triggered my ideas about purely function languages like Fexl. Classic stuff from the 80's. Thanks for the intriguing reference. > Also, look at his paper on "Dining Cryptographers" to see how > information-theoretically secure messages can be sent. > > Forget worrying about the details of various ciphers in Schneier's > book, at least until you have grasped the essence of not relying on > trust or "I promise not to look" b.s. schemes. Right, actually I'm scribbling out a system overview in terms of functions with specific properties independent of their implementation in modular arithmetic or anything else. Basic relationships like (encrypt (decrypt X)) = X, (unblind (sign (blind X))) = (sign X), (sign X) = (decrypt (hash X)). Definitions like a 'note' is <X, (sign X)>. Identifying which functions are secret to whom and which are public. Generation procedures such as: given a public 'encrypt' function, generate a random pair of functions <blind, unblind> with specific desirable properties. All without reference to any specific number-theoretic + padding implementations. This helps me get a feel for the whole flow of the system and all it implies. That plus a strong platform like OpenSSL (I presume) should yield good application code. I'm not much of a GUI guy, so I may just do a reasonably substantial API layer, a tight set of user-side command line primitives, and a socket-based server program. Or I may just throw in the towel and burrow around in the Lucrative code, but I'm not much of a Java guy either. > BTW, a more abstract book is Oded Goldreich's "Foundations of > Cryptography--Basic Tools," 2001. A little disorganized in places, but > lots of core concepts. > > When you have fully grokked the way messages can be sent without any > practical way of tracing their origin, as in the dining cryptographers > example, your eyes will be opened. And zero-knowledge interactive proof > systems (ZKIPS) will blow your mind. Never again will you argue in > terms of "trust me" and "so long as they don't subpoena me" and "I > promise not to look." Again, I must stress that I was never *knowingly* advocating that users must "trust me." I was not aware until yesterday that "trust me" was, in fact, an implied premise in my system. Certainly if there was some meta-certain way for users to know that my system was not keeping records, it could work just fine. But there isn't, so it couldn't. > (My simple explanation of ZKIPS in terms of demonstrating a Hamiltonian > cycle for a graph is in the archives, from around 1992-3.) Sounds great. Thanks again. - -- Patrick http://fexl.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPqnm4FA7g7bodUwLEQKYrwCg96E4VRcEhFU2jfKspzN1qvY5pM4AoJgl QLFXpOib+vwB1WSDTiJQI/8X =vZt3 -----END PGP SIGNATURE-----

1 0

Re: Thanks for the living hell, and question about OpenSSL
by Major Variola (ret) 25 Apr '03

25 Apr '03

At 04:13 PM 4/25/03 -0700, Tim May wrote: >Forget worrying about the details of various ciphers in Schneier's >book, Indeed. I entered crypto interested in how ciphers worked. (Avalanche, my boy, avalanche). But all you need to know is what they do, and a few properties of noise. Similarly with PK ciphers. Just know that RSA lets you use insecure channels, and you don't have to be online. DH does same, but requires online-ness. Only a few need actually worry about implementation details. The more sophisticated protocols that use these components --Blind this, Dining that, Split it N ways, Sign here-- are the building blocks that app designers ought to know. Again, one needs to know what's possible with the protocols, not how to do them. [This is not to say that undergrads should not be exposed to them, much as they derive things in school which later they'll merely know exist, and can look up if necessary. Neither is it to denigrate those who study, invent, maybe improve these things.] Got Montgomery multiplication?

1 0

Thanks for the living hell, and question about OpenSSL
by Patrick Chkoreff 25 Apr '03

25 Apr '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sincere thanks to everyone for the living hell I went through yesterday. I do understand the rationale for blinding now. The math was never the problem. I was mistakenly thinking that because my sacred code did not in fact record any IP-based transmission logs, users were safe as far as anonymity and privacy were concerned. What I missed was that if someone put a gun to my head and said "Put in some code to keep transmission logs and don't tell anybody or I'll kill your family," I would in fact obey and the security of the system would be compromised without anyone knowing. As RAH says, force monopolies are a bitch. So I'm taking blinding under my wing and working out some example scenarios of exactly how a system might work. I want to be able to describe it to novices. For example, you go to the post office and ship 10 gold coins to such-and-such bank. After they receive the coins, you fire up this program on your computer and do this-and-that. Then to transmit value to your friend in Helsinki, you do this other thing over here. Then your friend in Helsinki fires up a program and does such-and-such, and three days later 7 gold coins appear on his doorstep. That kind of thing. Something that makes a roomful of people who know nothing about modular arithmetic brighten up and think "Hey, I really think I could *use* that." On a technical note, I really like what I see at http://openssl.org and I'm mucking around with it as a possible platform. Does anybody have any comments or concerns regarding the suitability of OpenSSL for the purposes we are discussing here? - -- Patrick http://fexl.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPql8dlA7g7bodUwLEQKZVACgsNa3EpC7JbZU8uG2HiSmwuj91MoAoL4Z h5uLPRjXdbdOtCCTsclCAy8X =YlsU -----END PGP SIGNATURE-----

2 1