April 2004 - cypherpunks-legacy

Re: Vote Market
by Major Variola (ret) 19 Apr '04

19 Apr '04

At 09:25 AM 4/17/04 +1000, Tim Benham wrote: >I think all this concern about voter coercion is rather overblown. Maybe we >should ban bank statements because people might be coerced into showing them >to someone and punished for hiding their money. Receipts might open up >opportunities for voter coercion but there are mechanisms for combatting >coercion other than coercive anonymity. > >What is missing in this discussion is mention of the benefits which would flow >from making voter anonymity optional. Non-anonymous voting is a necessary >precondition for a vote market And that is why this list is still worth reading. Innovative socio-crypto speculation free of inhibition. Its interesting to consider what the economic benefits would be to individual voters, and the buyers. The bizmodel. How it varies with 'obedience' to one's vote-employer. Receipts give 100% obedience. No receipts could range from 0% to 100% depending on the population's behavior. In some races, buying 10% obedience in 30% of the population can swing a race. How many issues could a voter play, what kind of money are we talking about? The inertia (as in Men w/ Guns, besides insufficient anonymity / anoncash infrastructure) in getting such a market set up is large :-) Though in one sense, are the price of stock-shares the price of control-votes in guiding a private entity? Except confused by the value of the stock as an asset. PS: the Mw/G who want to see your ATM receipts already see them :-)

1 0

Blacknet voting
by Tyler Durden 19 Apr '04

19 Apr '04

I don't know...I've been following some of the voting discussion, and to some extent for the rank-and-file, doesn't this still boil down to "trust us"? (In other words, it looks like a large number of people have to work very carefully to make sure the voting system is secure, and then voters have to trust that the group did the work correctly.) Just riffing here, but isn't there some kind of possility for "Blacknet" voting? In other words, if the "voting machines" were by nature untamperable because of... 1) No one actually knows where they are 2) "They" aren't actually anywhere, perhaps being distributed entities on the network. In fact, votes pass into the voting blacknet and are untraceable. 3) The voting blacknet can be audited perhaps periodically (modula provisions for denial of service attacks), to make sure there's be no systematic tampering (which theoretically should be impossible anyway). OK, of course there are issues of multiple votes &c...but this seems no more difficult than digital cash. -TD >From: Yeoh Yiu <squid(a)panix.com> >To: Ed Gerck <egerck(a)nma.com> >CC: David Jablon <dpj(a)theworld.com>, John Kelsey <kelsey.j(a)ix.netcom.com>, > "Trei, Peter" <ptrei(a)rsasecurity.com>, cypherpunks(a)al-qaeda.net, > cryptography(a)metzdowd.com, "'privacy.at Anonymous Remailer'" ><mixmaster(a)remailer.privacy.at> >Subject: Re: voting >Date: 18 Apr 2004 23:12:24 -0400 > >Ed Gerck <egerck(a)nma.com> writes: > > > David Jablon wrote: > > > > > > The 'second law' also takes precedence: ballots are always secret, only > > vote totals are known and are known only after the election ends. > > > > > What I see in serious > > > voting system research efforts are attempts to build systems that > > > provide both accountability and privacy, with minimal tradeoffs. > > > > There is no tradeoff prossible for voter privacy and ballot secrecy. > > Take away one of them and the voting process is no longer a valid > > measure. Serious voting system research efforts do not begin by > > denying the requirements. > >You get totals per nation, per state, per county, per riding, >per precinct, per polling stion and maybe per ballot box. >So there's a need to design the system to have more voters >than ballot boxes to conform to your second law. > _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.com/go/onm00200415ave/direct/01/

1 0

Re: Anonymity vs reputation question
by An Metet 19 Apr '04

19 Apr '04

> Thinking about something, I found an interesting problem. It is possible > to set up a reputation-based system with nyms, where every nym is an > identity with attached reputation. > > Is it possible to have a system where nyms can share reputation without > divulging the links between them? That would allow the possibility of eg. > publishing as a "new" identity while still having the "weight" of an > already established seasoned professional. Yes, you can do this, but there are some problems. First, what is a reputation? Reputations are in people's minds. Any nym will have a different reputation with different people. The only way the new nym could have exactly the same reputation with everyone would be for it to be explicitly linked to the old nym, defeating the purpose of switching. Therefore the new nym's reputation will have to be a simple subset of the reputation of the old nym, in order that many nyms will have equal reputation and the new one won't be linked. This suggests a simple boolean ranking where one or more respected figures can give their endorsement to a nym, and then the new nym can start up and say that it is endorsed by so-and-so. As long as that person gave out quite a few endorsements then there will not be too much linkage to the old nym. As someone mentioned, this is the problem which is solved by cryptographic credentials, like those of Chaum or Brands. The "reputation judge" gives out an endorsement credential to those nyms he deems worthy; then through various cryptographic techniques these credentials can be shown by the new nyms. A simple version of this would be to use the same Chaum blind signatures that are used for ecash. When the reputation judge gives out the credential, in addition to signing the nym, he also issues a blind signature on a blinded identity offered by the nym owner. The judge can't see what nym he is signing, but later that nym can show that its identity is signed by the reputation judge. Brands credentials basically work this same way. A problem with this is that only one new nym gets endorsed, so the holder can only switch identities once. To fix this, the judge could issue several blind signatures, say about 5, which would accommodate that many identity switches. An even simpler approach would be for the reputation judge to create a common public key to be used as a signing key by everyone he endorses. When he endorses someone he reveals to them, privately, the secret key used to sign with the common public key. Then all nyms who have received the endorsement can sign with the common key in addition to their own. When the nym switches identities he still knows the common signing key and can sign with it along with the new nym. The problem with this class of systems is that if anyone leaks the common private key, then the security of the endorsement is lost and anyone can pretend to be endorsed. A similar flaw with the previous proposal is that if someone gets several blind endorsements, they might give some away or sell some, and the new buyers might misuse them, cheapening the value of the endorsement. Yet another method, good if there aren't more than a dozen or so nyms which are endorsed, is to use a ring or group signature. The reputation judge publishes a list of keys that he endorses, and then anyone on the list can make a signature which can be verified as coming from one of the keys, but there is no way to tell which one made it. This has a security problem similar with the 2nd approach, that someone on the list could secretly give away his private key to other people, and they could sign bad messages, with no way to tell which person on the list created them. The reputation judge could address this by withdrawing his endorsement of the last few list members, and seeing if the problem goes away, but it would be a complicated and messy situation.

1 0

Speakers: Payment Systems and Security 04 - June 18/19 2004
by R. A. Hettinga 18 Apr '04

18 Apr '04

<http://www.enhyper.com/paysec/agenda.html> Overview Agenda Presentations Venue Travel Accommodation Online Registration Corporate Sponsor: Contact Details Email: events(a)enhyper.com Telephone: +44 (0) 870 1996774 Payments Systems and Security 18/19th June 2004 Payments Systems and Security 18/19th June 2004 (Draft) Speakers * Geoff Chick, Product Director, Century 24 Solutions Integration Objects? * Dr Iain Saville, Head of Business Process Reform, Lloyds Kinnect - Taking Contracts Digital * Bill Millar, Head of Information Security Governance, Royal Bank of Scotland Security Governance * Ian Grigg, Principal Architect, Systemics Adaptive Governance for Payments and Securities Systems * Dr Sally Leivesley, Managing Director, Newrisk Limited Extreme Risk Management * John Walker, Principal Consultant, SiVenture (a division of NDS UK Ltd.) Unto the breach: breaking the hardware and cryptography of smart card chips * Alistair Dunlop, Director of the Open Middleware Infrastructure Institute, University of Southampton Grid Computing based Open Source Web Services * Paul Guthrie, Principal, Payment Software Corporation Applying digital cash ideas to Commerce * Ir. Simon Lelieveldt, S. Lelieveldt Consultancy How New Entrants Change the Traditional Security Approach to Payments * Frank Trotter, CEO, Everbank Blazing the Branchless Banking Trail - The Highs and Lows of Adoption and Security Issues * Graeme Burnett, Quantitative Technology Achitect, Deutsche Bank Future State Application Security Architecture * James Turk, Managing Director, Goldmoney Internet Gold - the new Governance * Avi Corfas, Managing Director EMEA, Skybox Security Vulnerability Management Needs A New Model: The Role of Attack Simulation in Automation Copyright ) 2004 Enhyper Ltd. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Overview: Payments Systems and Security 18/19th June 2004
by R. A. Hettinga 18 Apr '04

18 Apr '04

<http://www.enhyper.com/paysec/> Enhyper - Payment Systems and Security 04 - June 18/19 2004 Overview Agenda Presentations Venue Travel Accommodation Online Registration Contact Details Email: events(a)enhyper.com Tel: +44 (0) 870 1996774 Payments Systems and Security 18/19th June 2004 Enhyper are proud to announce a conference with a difference, to be held at The Innholders Hall on 18/19th Jun 2004. Overview At PaySec2004 we've brought together payment systems developers, security architects, operational risk practitioners and academics to address all aspects of technology, security and operation in the payment systems domain, both present and future state. The best of the Internet versus the best of the City. Short key technical demonstrations will be interspersed to bring context to the challenges and the solutions. Rump sessions will allow you to contribute your experiences for the benefit of others. Headline Topics The conference will cover many crucial topics in the Payment Systems field: * Payment Transformations and integration: a revolutionary code generation approach * Settlement to T+0 and RTGS * Programmatic electronic contract negotiation * Systems Performance Monitoring: Service Level Compliance * Extensible Electronic Currency Frameworks * SSL/SSH based infrastructure to enhance federated security * Payment Systems as Critical National Infrastructure * Automated System Risk Audits for Operational Risk Compliance * Strategies for Defending against Infrastructure Attacks * Reusable Security Architecture via pre-risk assessed patterns Conference Ethos Security of payments is more than the application of cryptography over the the Internet, and more than a secured private network between banks: it is the application of all of the disciplines - technology, a legal framework, risk analysis and mitigation, insurance, good management practice and strong accounting. Our desire is to bring the following four streams together in one conference in the context of applied security: Applications, Infrastructure, Risk and Research. Applications Blending today's payment systems providers with state-of-the-art payment technology developers combines experience with innovative technology. * An Escape From Hard-Coded Application Integration: Demonstration and discussion of a highly scalable message format definition, transformation and transport modelling toolset which solves data integration issues for legacy systems, message-orientated middleware and XML based messaging systems. * Electronic Payments and Contracts: Live demonstration and discussion of several payments frameworks and electronic contract mechanisms. Discussion of operational aspects and how new financial instruments can be supported. Infrastructure Computer infrastructure is changing from service-based to web service delivery. To deliver these services, Grid Infrastructures offer enhanced platform utilistation and massive scalability. * From Client/Server to Grid-based Web Services: Government see grid computing as the powerhouse behind a new economy. We meet the Director of the UK Government's initiative. * Application Security and Risk Assessment: Security is no longer that last final step before production. Threat analysis must be considered on all levels, not just any single one. Risk assessment is no longer a subjective, paper based exercise. Many organisations face the challenge of measuring their level of security, their level of risk and their progress in securing their IT resources. We present a framework for the reuse of security architecture patterns which streamlines the whole development process and greatly enhances application security and awareness. Automated risk assessment techniques will be demonstrated in a revolutionary approach to network vulnerability. Risk The 21st century has brought risks and attacks never previously thought realistic outside a Hollywood movie, but now have to be analysed, quantified, and prepared for. * Payment Systems as Critical National Infrastructure: Discussion of the threats posed by CNBR Research Regulatory and billing systems that assume one simple security model are already under strain, and will need to accomodate the new efficient security models of micropayments. The entry of the mobile phone into the payments platform will lead to increasing convergance pressures on Banks and Telcos. The Event The conference is held on a Friday and Saturday in a friendly, relaxed, cooperative environment, led by experienced payment industry professionals in a venue which combines the traditional with the modern - one of the City of London's oldest Livery halls with a WiFi network connected to the internet. There'll be opportunity to share your experience and hear that of others at one of our five minute rump sessions. Copyright ) 2004 Enhyper Ltd. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Payment system and security conference
by R. A. Hettinga 18 Apr '04

18 Apr '04

--- begin forwarded text

1 0

Re: [Community_studios] Apple's jackboots step on PlayFair in India
by proclus＠gnu-darwin.org 18 Apr '04

18 Apr '04

woohoo! here is another one. http://p2pnet.net/story/1193 http://www.p2pnet.net/playfair/playfair-0.4.tar.gz Regards, proclus http://www.gnu-darwin.org/ -- Visit proclus realm! http://proclus.tripod.com/ -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GMU/S d+@ s: a+ C++++ UBULI++++$ P+ L+++(++++) E--- W++ N- !o K- w--- !O M++@ V-- PS+++ PE Y+ PGP-- t+++(+) 5+++ X+ R tv-(--)@ b !DI D- G e++++ h--- r+++ y++++ ------END GEEK CODE BLOCK------

1 0

Payment system and security conference
by lynn.wheeler＠firstdata.com 18 Apr '04

18 Apr '04

reminder from this month's enhyper newsletter, 2004 payment system and security conference http//www.enhyper.com/paysec/ also mention financial cryptography blog ... by some of the same people http//www.financialcryptography.com/ they also have short blurb on: http://www.bitpass.com/ enhyper also discovered norm hardy and some of his papers: ... the digital silk road http//www.cap-lore.com/Economics/DSR/ http//www.agorics.com/Library/dsr.html norm's past include LLNL, 360s, vm/370, secure operating systems and secure transactions: http://cap-lore.com/ and secure operating systems at tymshare with gnosis and keykos: http//www.agorics.com/Library/keykosindex.html http//www.cis.upenn.edu/~KeyKOS/ .... and there is EROS -- extremely reliable operation system (outgrowth of keykos) http//www.cis.upenn.edu/~eros/ ... note above mentions looking at getting an EAL7+ evaluation for eros. when MD bought tymshare they were looking at spinning off a number of things. i was brought in to do a technical audit of gnosis as part of its spin-off as keykos. they were also spinning off Doug Engelbart who was working at Tymshare at the time ... tymshare was running doug's "augment" system on pdp10 ... http//www.superkids.com/aweb/pages/features/mouse/mouse.html http//sloan.stanford.edu/MouseSite/dce-bio.htm http//www.invisiblerevolution.net/engelbart/glossary/augment_nls.html http//www.sciencedaily.com/encyclopedia/nls and total topic drift, i've got lots of references to vm/370: http://www.garlic.com/~lynn/subtopic.html#545tech http://www.garlic.com/~lynn/subtopic.html#fairshare http://www.garlic.com/~lynn/subtopic.html#wsclock -- Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Payment system and security conference
by lynn.wheeler＠firstdata.com 18 Apr '04

18 Apr '04

reminder from this month's enhyper newsletter, 2004 payment system and security conference http//www.enhyper.com/paysec/ also mention financial cryptography blog ... by some of the same people http//www.financialcryptography.com/ they also have short blurb on: http://www.bitpass.com/ enhyper also discovered norm hardy and some of his papers: ... the digital silk road http//www.cap-lore.com/Economics/DSR/ http//www.agorics.com/Library/dsr.html norm's past include LLNL, 360s, vm/370, secure operating systems and secure transactions: http://cap-lore.com/ and secure operating systems at tymshare with gnosis and keykos: http//www.agorics.com/Library/keykosindex.html http//www.cis.upenn.edu/~KeyKOS/ .... and there is EROS -- extremely reliable operation system (outgrowth of keykos) http//www.cis.upenn.edu/~eros/ ... note above mentions looking at getting an EAL7+ evaluation for eros. when MD bought tymshare they were looking at spinning off a number of things. i was brought in to do a technical audit of gnosis as part of its spin-off as keykos. they were also spinning off Doug Engelbart who was working at Tymshare at the time ... tymshare was running doug's "augment" system on pdp10 ... http//www.superkids.com/aweb/pages/features/mouse/mouse.html http//sloan.stanford.edu/MouseSite/dce-bio.htm http//www.invisiblerevolution.net/engelbart/glossary/augment_nls.html http//www.sciencedaily.com/encyclopedia/nls and total topic drift, i've got lots of references to vm/370: http://www.garlic.com/~lynn/subtopic.html#545tech http://www.garlic.com/~lynn/subtopic.html#fairshare http://www.garlic.com/~lynn/subtopic.html#wsclock -- Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Behavior pattern recognition
by Thomas Shaddack 18 Apr '04

18 Apr '04

http://us.cnn.com/2004/TRAVEL/04/16/airline.behavior.ap/ http://www.usatoday.com/travel/news/2004-04-16-behaviorscan_x.htm http://news.bostonherald.com/national/view.bg?articleid=1780 Carnival Booth, anyone? Besides, it's matter of time until the checklists "leak" and the "adversaries" adjust their behavior accordingly. (What would be the next move then?). The "anyone observing security methods" is the funniest part. I am not certain how one can avoid it, given the amount of time to kill that's usually present on the airports (is killing time a terrorist act?) - sooner or later all the tiles on the floor and the panels on the ceiling are counted, and what's left to watch is the guards and the cameras. Wouldn't it be less prone to false positives if they would optimize the airport operations so people won't have to stay there long enough to get bored and start noticing the security holes?

1 0