July 2003 - cypherpunks-legacy

Re: Digicash Patents
by R. A. Hettinga 05 Aug '03

05 Aug '03

Okay, so I called my source up, and we chatted a bit Long story short, Infospace, the company that up until now had Chaum's original blind signature patents, sold them, in a bundle of other stuff, to First Data, in a reorganization. First Data is the largest credit-card processor in the US, among other things, but they bought the original Digicash patents as a way to get at an authentication technology they were paying Infospace to use already, and a business that Infospace, in the middle of its own litigation circus, wanted out of, offering it to its two biggest customers, First Data and American Express. First Data bought it, apparently, as the people in Seattle, who used to work eCash Technologies -- and then Infospace -- are supposedly getting their checks from First Data now. Since lots of the important bits are supposed to expire next year, the patents may or may not be useful. On the other hand, if they can be gotten clear, someone could get a running start, I suppose, especially if they made a partnership deal with First Data of some kind, and, if First Data was active in that partnership, leveraging their other connections in the funds-transfer business, that could be interesting. On the other other hand, :-), it's entirely clear that people could be developing code right now in anticipation of the patent expiration and go live with some kind of land rush when it's possible to do so. Plug a mint into an account at GoldMoney, or e-Gold, or even PayPal, if they partner with *them* -- and see what happens... Cheers, RAH -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

5 6

Re: Digicash Patents
by Mac Norton 31 Jul '03

31 Jul '03

I'm not sure that Paypal has met the needs of any enduser yet, so I'd question whether it "succeeded." The rest of what you say seems to be to the point that modern "IP" laws tend to discourage creativity. To some extent this may be so, as with interminable term extensions, but the most immediate discouragement lies in the DMCA, not an "IP" law at all but a grant of rather unprecedented monopoly power, irrespective of creative labor, among other items of note. Macon -----Original Message----- From: Tim May [mailto:timcmay@got.net] Sent: Thursday, July 31, 2003 4:35 PM To: cypherpunks(a)lne.com Subject: Re: Digicash Patents PayPal apparently met the needs of its customers, which was for a low-tech, low-security, no anonymity online payment system. While I'm not saying I predicted it, neither is it surprising that something like it succeeded. (Members of this very list had some discussions with the guy who started PayPal...I wasn't in on this, but I gather that he used some of the ideas, but not the high security/untraceability ideas...just the online payment low-hanging fruit part. The same is true of EBay, by the way, where some of our crowd developed an online system very much like what E-Bay became, but several years _after_ the AMiX system. C'est la vie.) In any case, there will be many successes and failures in Internet-related business. This list is about certain kinds of these systems, but not really about "online payments" in their general form. I'm not saying folks can't or shouldn't talk about Mondex or PayPal or FastTrack, just that they have little to do with the obvious themes of the group. > > The beauty of a marketplace is that many different parties get > to try every which way of satisfying a need. Most will fail. Even the > first several attempts can fail, disguising a real opportunity as a > guaranteed failure. > Software patents and the difficulty of "metering" usage has made this kind of experimentation, this kind of evolutionary learning, much harder to do. For example, when Intel sold the 4004 microprocessor 30 years ago, it owned a bunch of patents and trade secrets about how the chip was made, what it's design was, etc. But it didn't force potential customers to lay out their business plans, to sign "no compete" clauses, and it did not have to devise complex ways of knowing how many chips a customer was using. The chips metered themselves, metered the patents and other IP, and Intel could sell them to guys in garage shops, companies in Boise and Peoria, and even to distributors to resell and resell. Such is not the case with, say, the Digicash software. Since Chaum, then the Canadians, then the Indians, then First Data, etc., wanted to maximize the payoff and "get a piece of the action," they could not simply sell the technology, even bits of it, to guys in garages and people with bizarre and untested ideas. And such software is usually not sold to unidentifiable customers. Digicash (or its descendants) will not sell one copy of its core technology to a company without draconian safeguards and audits. This is part of why a paper trail back to the users of various technologies exist when above-board licensing is used. (And why many of us would obviously then favor simply _taking_ the technology, ripping it off. This cuts the paper and liability trail. Yes, there are minor issues with "theft of intellectual property," but this is mostly smoke and mirrors anyway. No one in the Western world seems to think ideas in general are patentable, so how did RSA get patented? We've had this discussion many times over the past 11 years. And more.) This is replicated all over the digital landscape, where software packages have complicated licensing schemes and where vendors want to see only "staid and conservative" business plans. No Digicash for BlackNet, in other words. This whole phenomenon has dramatically slowed down exploratory developement and weird, new ideas. A couple of guys in a tilt-up in Silicon Valley simply cannot just go down to Fry's to buy some parts and try out some ideas, not in this world of licenses, audits, lawyers, and generally pointless efforts to meter usage. Which is why doing things without benefit of any patent licenses is the best strategy. That this also requires no nexus, no trail back to a corporate office, is of course part of why it's the best strategy. --Tim May

1 0

'Progressive' Lawyer Group Ready To Challenge Formidable Federalist Society (fwd)
by Jim Choate 31 Jul '03

31 Jul '03

http://ap.tbo.com/ap/breaking/MGANV71TSID.html -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Poindexter to Quit Pentagon Post Amid Controversy
by R. A. Hettinga 31 Jul '03

31 Jul '03

<http://reuters.com/printerFriendlyPopup.jhtml?type=topNews&storyID=3198102> Reuters News Article Poindexter to Quit Pentagon Post Amid Controversy Thu July 31, 2003 01:59 PM ET WASHINGTON (Reuters) - John Poindexter, the retired Navy admiral who spearheaded two sharply criticized Pentagon projects, intends to resign from his Defense Department post within weeks, a senior U.S. defense official said on Thursday. "It's my understanding that he ... expects to, within a few weeks, offer his resignation," the official, speaking on condition of anonymity, told reporters. Poindexter was involved with the Defense Advanced Research Projects Agency's abandoned futures-trading market for predicting assassinations, terrorism and other events in the Middle East, and earlier with the so-called Total Information Awareness program that drew fire from civil rights groups. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Secure IDE?
by pgut001＠cs.auckland.ac.nz 31 Jul '03

31 Jul '03

"Trei, Peter" <ptrei(a)rsasecurity.com> writes: >pgut001@cs.auckland.ac.nz[SMTP:pgut001@cs.auckland.ac.nz] >>"Trei, Peter" <ptrei(a)rsasecurity.com> writes: >>>with a good distribution of IVs >> >>Where would you store them? The feature of this is that it's fully >>transparent, so you can't store IVs anywhere. > >I'm not really up on crypto file systems, but I beleive at least some use the >sector address as the IV. IVs don't need to be random, secret, or >unpredictable - they just need to be unrepeated. (I'm assuming sector-at-a- >time encryption). But the IV is repeated, every time you encrypt new data for that sector. You need to either store a random IV for each sector (usually infeasible) or make two passes over the data (details vary), using the output from pass 1 to affect pass 2 (slow). >>>* Some kind of PIN or password protection on the dongle. >> >>How would you do this without a custom BIOS (remember that their general >>product is for dropping into any PC)? > >We're talking about two different products. The ABIT is a MB, presumably with >it's own custom BIOS, so that's not an issue there. Customised, not custom. Think of it as a Chinese-menu type setup, it's a one- size-fits-all BIOS with appropriate modules compiled in for handling the CPU and chipset features. Now motherboard vendors can plug in their own feature modules, but it's a somewhat nontrivial option usually used only for highly marketable features (overclocking options, ability to re-flash from Windows, etc etc). Peter.

2 1

Life is not economics.
by Jim Choate 31 Jul '03

31 Jul '03

On Thu, 31 Jul 2003, Professor Rat. wrote: > the shoat brings it up,life is not propping up statist dictatorships either > so what have you done for us lately? Choate? What have you done at all? -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: Someone at the Pentagon read Shockwave Rider over the weekend
by Jim Choate 31 Jul '03

31 Jul '03

On Tue, 29 Jul 2003, Mac Norton wrote: > Tim has identified the problems, including what may be the most important > one, that the "market," unlike other such markets, is subject to gaming > for motives that are other than economic. Actually this is the fundamental failure of your view, Tim's, and most other CACL sorts. ALL markets are subject to parameters that are -not- subject to strictly economic motives. In fact a purely 'economic motive' isn't fundamentally about money, it's about either insecurity or power, it's about inter-personal relationships. It's about 'using'. -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

RE: Secure IDE?
by Trei, Peter 31 Jul '03

31 Jul '03

> pgut001@cs.auckland.ac.nz[SMTP:pgut001@cs.auckland.ac.nz] wrote: > > > "Trei, Peter" <ptrei(a)rsasecurity.com> writes: > > >No info on chaining modes, if any, nor of IV handling. > > DES/ECB, originally with a 40-bit key, more recently with 56-bit and 3DES. > Keys generated by the manufacturer onto a USB dongle. No easy way to make > backups of the dongle. It's a messy tradeoff: If you want something like > laptop/data-theft-protection (which will suit the majority of the market), > then DES-40/ECB is fine, but you want to be able to back up the dongle > because > if that goes (and after multiple insertions and removals it will) you've > lost > all your data. OTOH if you want protection from the MIB the fragile > nature of > the key storage is probably a benefit, but then you want 3DES/CBC to go > with > it. At the moment you have laptop-theft-protection crypto and > MIB-protection > key storage. > > You can buy truckloads of these things on ebay for about $20 a pop if you > want > to play with one. > > Peter. > Color me dissapointed. It's a move in the right direction, but I wish they had followed through and done the right things: * [AES | 3DES]/CBC with a good distribution of IVs * User-generated keys (before initial disk setup, of course). * Shutdown on dongle removal. * Some kind of PIN or password protection on the dongle. eNova claims not to keep a database of keys (they don't say that 'there is no database of keys', which is a little different), and to get a key copied you have to send it to them. They do seem to supply a spare. Back a few years ago, I calculated that with the DES key search software then available, a single 200MHz machine could search 40 bits of keyspace over a long weekend. Today it would take a few hours. 40 bit DES is not secure against your kid sister (if she's a cypherpunk :-), much less industrial espionage. Quote from http://www.abit.com.tw/abitweb/webjsp/english/mb_spec.jsp?pPRODUCT_TYPE=Moth erBoard&pMODEL_NAME=SecureIDE : "40-bit DES (US Data Encryption Standard) is adequate for general users" Yeah. Right. Peter

1 0

RE: Secure IDE?
by pgut001＠cs.auckland.ac.nz 31 Jul '03

31 Jul '03

"Trei, Peter" <ptrei(a)rsasecurity.com> writes: >No info on chaining modes, if any, nor of IV handling. DES/ECB, originally with a 40-bit key, more recently with 56-bit and 3DES. Keys generated by the manufacturer onto a USB dongle. No easy way to make backups of the dongle. It's a messy tradeoff: If you want something like laptop/data-theft-protection (which will suit the majority of the market), then DES-40/ECB is fine, but you want to be able to back up the dongle because if that goes (and after multiple insertions and removals it will) you've lost all your data. OTOH if you want protection from the MIB the fragile nature of the key storage is probably a benefit, but then you want 3DES/CBC to go with it. At the moment you have laptop-theft-protection crypto and MIB-protection key storage. You can buy truckloads of these things on ebay for about $20 a pop if you want to play with one. Peter.

1 0

RE: Someone at the Pentagon read Shockwave Rider over the weekend (fwd)
by Jim Choate 31 Jul '03

31 Jul '03

> ---------- Forwarded message ---------- > Date: Tue, 29 Jul 2003 14:49:51 -0400 > From: "Trei, Peter" <ptrei(a)rsasecurity.com> > Over on Dave Farber's IP list, it's been pointed out that there > is a pre-existing, live, real-money market in futures on these > types of events. Go over to www.tradesports.com, and click on > 'Current Events' under 'Trading Catagories' on the left. Drill down > and you'll find things like 'WMDs will be found in Iraq on or before > Sept 31', the value of which has dropped from 80 to 25 over the > last few months. Which only goes to show how inaccurate and generaly confused these sorts of systems are. Based on what people feel rather than what they know. The failure of all free markets to conform to what 'economists' consider the ideal. This example actually blows your whole suppostion away. -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0