July 2018 - cypherpunks-legacy

[fc-announce] CF Workshop Proposals for FC10. Deadline: June
by Pino Caballero 06 Jul '18

06 Jul '18

15, 2009 We apologize in advance if you receive multiple copies of this CFP. *************************************************** Financial Cryptography and Data Security 2010 Tenerife, Canary Islands, Spain 25-29 January 2010 http://fc10.ifca.ai CALL FOR Workshop Proposals. Proposals for workshops to be held at FC 2010 are solicited. A workshop can be full day or half day in length. Workshop proposals should include: (i) a title, (ii) a call for papers, (iii) a brief summary and justification -- including how it would fit into the greater FC scope, (iv) a (tentative) Program Committee and its Chair, (v) one-paragraph bios for key organizers, and (vi) the expected (or previous - if workshop has been held in previous years) number of submissions, participants and acceptance rates. Workshop proposals should be sent fc10workshops(a)ifca.ai <https://correoweb.ccti.ull.es/imp/message.php?index=1#>. IMPORTANT DATES Workshop Submission: June 15, 2009 Workshop Notification: June 30, 2009 ORGANIZERS General Chair: Pino Caballero-Gil, University of La Laguna Local Chair: Candelaria Hernandez-Goya, University of La Laguna Proceedings Chair: Reza Curtmola, New Jersey Institute of Technology Poster Chair: Peter Williams, Stony Brook University Local Committee: Luisa Arranz Chacon, Alcatel Espana, S.A. Candido Caballero Gil, University of La Laguna Felix Herrera Priano, University of La Laguna Belen Melian Batista, University of La Laguna Jezabel Molina Gil, University of La Laguna Jose Moreno Perez, University of La Laguna Marcos Moreno Vega, University of La Laguna Alberto Peinado Dominguez, University of Malaga Alexis Quesada Arencibia, University of Las Palmas de Gran Canaria Jorge Ramio Aguirre, Polytechnic University of Madrid Victoria Reyes Sanchez, University of La Laguna PROGRAM COMMITTEE Program Chair: Radu Sion, Stony Brook University Ross Anderson, University of Cambridge Lucas Ballard, Google Inc. Adam Barth, UC Berkeley Luc Bouganim, INRIA Rocquencourt Bogdan Carbunar, Motorola Labs Ivan Damgard, Aarhus University Ernesto Damiani, University of Milano George Danezis, Microsoft Research Sabrina de Capitani di Vimercati, University of Milano Rachna Dhamija, Harvard University Sven Dietrich, Stevens Institute of Technology Roger Dingledine, The TOR Project Josep Domingo-Ferrer, University of Rovira i Virgili Stefan Dziembowski, University of Rome "La Sapienza" Bernhard Esslinger, Siegen University Simone Fischer-H|bner, Karlstad University Amparo Fuster-Sabater, Instituto de Fmsica Aplicada Madrid Philippe Golle, Palo Alto Research Center Dieter Gollmann, Technische Universitaet Hamburg-Harburg Rachel Greenstadt, Drexel University Markus Jakobsson, Palo Alto Research Center and Indiana University Rob Johnson, Stony Brook University Ton Kalker, HP Labs Stefan Katzenbeisser, Technische Universitdt Darmstadt Angelos Keromytis, Columbia University Lars R. Knudsen, Technical University of Denmark Wenke Lee, Georgia Tech Arjen Lenstra, Ecole Polytechnique Federale de Lausanne (EPFL) and Alcatel-Lucent Bell Laboratories Helger Lipmaa, Cybernetica AS Javier Lopez, University of Malaga Luigi Vincenzo Mancini, University of Rome "La Sapienza" Refik Molva, Eurecom Sophia Antipolis Fabian Monrose, University of North Carolina at Chapel Hill Steven Murdoch, University of Cambridge David Naccache, Ecole Normale Superieure (ENS) David Pointcheval, Ecole Normale Superieure (ENS) and CNRS Bart Preneel, Katholieke Universiteit Leuven Josep Rifa Coma, Autonomous University of Barcelona Ahmad-Reza Sadeghi, Ruhr-University Bochum Angela Sasse, University College London Vitaly Shmatikov, University of Texas at Austin Miguel Soriano, Polytechnic University of Catalonia Miroslava Sotakova, Aarhus University Angelos Stavrou, George Mason University Patrick Traynor, Georgia Tech Nicholas Weaver, International Computer Science Institute Berkeley The Financial Cryptography and Data Security Conference is organized by The International Financial Cryptography Association (IFCA). _______________________________________________ fc-announce mailing list fc-announce(a)ifca.ai http://mail.ifca.ai/mailman/listinfo/fc-announce

1 0

ids
by None 06 Jul '18

06 Jul '18

Hey i got your email from a message board. But since it seems you know enough about fake ids. I had a question and i was hoping you could answer it for me. I wanted to get a new identity and i was told i could do it two ways. 1 way was to steal a living persons identity, and the other was to steal a dead persons id. write back if you know anything to help me. _______________________________________________________ Say Bye to Slow Internet! http://www.home.com/xinbox/signup.html

1 0

Re: [IP] on crypto systems from CTO PGP
by Brad Templeton 06 Jul '18

06 Jul '18

On Mon, Jul 10, 2006 at 06:04:17AM -0400, David Farber wrote: >Modern cryptographic systems are essentially unbreakable, >particularly if an adversary is restricted to intercepts. We have >argued for, designed, and built systems with 128 bits of security >.... >If you want to brute-force a key, it literally takes a planet-ful of >... >They could know something we don't. They could know some fundamental >truth about mathematics (like how to factor really fast), some >effective form of symmetric cryptanalysis, or something else. They >could know about quantum computers, DNA computers, systems based upon While it is also a non-scientific statement, this history of "unbreakable" cryptography is checkered. Significant numbers of systems judged unbreakable using the thinking of the day have ended up having flaws. Some claims of unbreakability also fell victim to the unexpected push of Moore's law (such as DES, which we at the EFF demonstrated the crackability of many years ago.) One of my favourite charts at a crypto conference did a graph between the predicted lifetime of cryptosystems (often expressed, in terms of tens of thousands of years, or now lifetimes of the universe) and the actual lifetime under unanticipated cryptanalysis techniques. It was meant to be an amusement but it looked like a real trend. 2^128 will not be readily brute-forced with the technology we envision today. The point is that most of these systems were not broken with the technology (and other aspects of cryptanalysis) we know today. Each flaw found in a cryptosystem makes our next system stronger, of course, but it's very risky to say we've found the last flaw, discovered the last breakthrough in cryptanalysis. As for quantum computing, a classmate of mine has endowed a center for quantum computing at Waterloo, using his RIM money. I asked him recently how many q-bits they could do, he told me they had classified the answer. That could mean they are being overly paranoid in their classifications (quite likely) or that they have classified it because they wonder if the future answer will be military level, or if they have classified it just to keep people wondering. But one can't help but wonder. All this said, I feel pretty confident in our modern systems. But not enough to say essentially unbreakable. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on on crypto systems from CTO PGP
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

FC: Text of draft Security Systems Standards and Certification Act
by Declan McCullagh 06 Jul '18

06 Jul '18

Wired News article on SSSCA: http://www.wired.com/news/politics/0,1283,46655,00.html --- http://www.politechbot.com/docs/hollings.090701.html Text of Security Systems Standards and Certification Act Sponsors: Sen. Fritz Hollings (D-S.C.), chairman of the Senate Commerce committee, and Sen. Ted Stevens (R-Alaska). Draft dated August 6, 2001. This bill has not been introduced as of September 7, 2001. Keystroked by Declan McCullagh, all typos his. Comments in [brackets] are his. The bill is 19 pages long; much of the text is summarized and placed in brackets. _________________________________________________________________ Title I -- Security System Standards Sec. 101: Prohibition of Certain Devices (a) In General -- It is unlawful to manufacture, import, offer to the public, provide or otherwise traffic in any interactive digital device that does not include and utilize certified security technologies that adhere to the security system standards adopted under section 104. (b) Exception -- Subsection (a) does not apply to the offer for sale or provision of, or other trafficking in, any previously-owned interactive digital device, if such device was legally manufactured or imported, and sold, prior to the effective date of regulations adopted under section 104 and not subsequently modified in violation of subsection (a) or 103(a). Sec. 102: Preservation of the Integrity of Security An interactive computer service shall store and transmit with integrity any security measure associated with certified security techologies that is used in connection with copyrighted material or other protected content such service transmits or stores. Sec. 103: Prohibited Acts (a) Removal or Alteration of Security -- No person may -- (1) remove or alter any certified security technology in an interactive digital device; or (2) transmit or make available to the public any copyrighted material or other protected content where the security measure associated with a certified security technology has been removed or altered. [Summary: Personal TV/cable/satellite time-shifting copies normally must be allowed by certified security technologies] Sec. 104: Adoption of Security System Standards [Summary: The private sector has 12 months to agree on a standard, or the Secretary of Commerce will step in. Industry groups that can participate: "representatives of interactive digital device manufacturers and representatives of copyright owners." If industry can agree, the secretary will turn their standard into a regulation; if not, normal government processes apply and NTIA takes the lead. The standard can be later modified. The secretary must certify technologies that adhere to those standards. Also: "The secretary shall certify only those conforming technologies that are available for licensing on reasonable and nondiscriminatory terms." FACA, a federal sunshine law, does not apply, and an antitrust exemption is included.] Sec. 108: Enforcement The provisions of section 1203 and 1204 of title 17, United States Code, shall apply to any violation of this title as if -- (1) a violation of section 101 or 103(a)(1) of this Act were a violation of section 1201 of title 17, United States Code; and (2) a violation of section 102 or section 103(a)(2) of this Act were a violation of section 1202 of that title. Sec. 109. Definitions In this title: (1) Certified security technology -- The term "certified security technology" means a security technology certified by the Secretary of Commerce under section 105. (2) Interactive computer service -- The term "interactive computer service" has the meaning given that term in section 230(f) of the Communications Act of 1984 (47 U.S.C. 230(f)). [Note: According to 47 U.S.C. 230(f), an "interactive computer service" means "any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions."] (3) Interactive digital device -- The term "interactive digital device" means "any machine, device, product, software, or technology, whether or not included with or as part of some other machine, device, product, software, or technology, that is designed, marketed or used for the primary purpose of, and that is capable of, storing, retrieving, processing, performing, transmitting, receiving, or copying information in digital form." (4) Secretary -- The term "Secretary" means the Secretary of Commerce [Takes effect at the date of enactment, except for sections that wait for federal standard.] Title II -- Internet Security Initiatives [Summary: Creates 25-member federal "Computer Security Partnership Council." Funds NIST computer security program at $50 million starting in FY2001, increasing by $10 million a year through FY2006. Funds computer security training program starting at $15 million in FY2001. Creates federal "computer security awards." Requires NIST to encourage P3P and similar privacy standards] _________________________________________________________________ Penalties summarized (by Declan): Criminal penalties apply to violations of sec. 102 or 103(a)(2). That includes the "interactive computer service shall store and transmit" without removal section, and the distribute "any copyrighted material or other protected content where the security measure associated with a certified security technology has been removed or altered." The criminal penalties are: "(1) shall be fined not more than $500,000 or imprisoned for not more than 5 years, or both, for the first offense; and (2) shall be fined not more than $1,000,000 or imprisoned for not more than 10 years, or both, for any subsequent offense." Only someone who violates the law "willfully and for purposes of commercial advantage or private financial gain" can be convicted. Civil penalties apply to violations of sec. 101 or 103(a)(1). That includes the section talking about how it's unlawful to make systems without security measures, and how nobody may "remove or alter any certified security technology in an interactive digital device." The civil penalties include injunctions in federal court, actual damages, and statutory damages. ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

Re: [cryptography] bitcoin scalability to high transaction rates
by Marsh Ray 06 Jul '18

06 Jul '18

On 07/20/2011 08:24 AM, Ian G wrote: > > Yes, sure, but: > > 1. we are talking about high frequency trading here, and speed is the > first, second and third rule. Each trade could be making 10k++ and up, > which buys you a lot of leaches. > > Basically, you have to get the trade down to the cost of a packet, delay > and two secret key ops. Indeed, if you can measure the delay of the > secret key op, we might be encouraged to pre-calculate shared PRNG > streams so as to speed up the encrypt/decrypt cycle. I once spoke with some engineers who built and run one of those high-speed electronic trading networks/exchanges. Their time to match trades was something like 50 microseconds. Their serious members colocated their trading systems in their datacenter because it was so critical to eliminate the propagation delay. I guess I don't see the need to do bitcoin crypto transactions at that speed any more than the other high-speed exchanges need to rapidly move stock certificates, hard cash, or perform ACH/EFTs. > (Gee I wonder if I should file a patent on that idea :P ) Maybe you could be the next Certicom! ^_^ > This and other aspects of high frequency trading forces a credit > exposure to the trades, which requires someone to step in and control > that credit. But the term "high speed electronic exchange" seems to mean exactly this, almost by definition. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

FC: Text of draft Security Systems Standards and Certification Act
by Declan McCullagh 06 Jul '18

06 Jul '18

Wired News article on SSSCA: http://www.wired.com/news/politics/0,1283,46655,00.html --- http://www.politechbot.com/docs/hollings.090701.html Text of Security Systems Standards and Certification Act Sponsors: Sen. Fritz Hollings (D-S.C.), chairman of the Senate Commerce committee, and Sen. Ted Stevens (R-Alaska). Draft dated August 6, 2001. This bill has not been introduced as of September 7, 2001. Keystroked by Declan McCullagh, all typos his. Comments in [brackets] are his. The bill is 19 pages long; much of the text is summarized and placed in brackets. _________________________________________________________________ Title I -- Security System Standards Sec. 101: Prohibition of Certain Devices (a) In General -- It is unlawful to manufacture, import, offer to the public, provide or otherwise traffic in any interactive digital device that does not include and utilize certified security technologies that adhere to the security system standards adopted under section 104. (b) Exception -- Subsection (a) does not apply to the offer for sale or provision of, or other trafficking in, any previously-owned interactive digital device, if such device was legally manufactured or imported, and sold, prior to the effective date of regulations adopted under section 104 and not subsequently modified in violation of subsection (a) or 103(a). Sec. 102: Preservation of the Integrity of Security An interactive computer service shall store and transmit with integrity any security measure associated with certified security techologies that is used in connection with copyrighted material or other protected content such service transmits or stores. Sec. 103: Prohibited Acts (a) Removal or Alteration of Security -- No person may -- (1) remove or alter any certified security technology in an interactive digital device; or (2) transmit or make available to the public any copyrighted material or other protected content where the security measure associated with a certified security technology has been removed or altered. [Summary: Personal TV/cable/satellite time-shifting copies normally must be allowed by certified security technologies] Sec. 104: Adoption of Security System Standards [Summary: The private sector has 12 months to agree on a standard, or the Secretary of Commerce will step in. Industry groups that can participate: "representatives of interactive digital device manufacturers and representatives of copyright owners." If industry can agree, the secretary will turn their standard into a regulation; if not, normal government processes apply and NTIA takes the lead. The standard can be later modified. The secretary must certify technologies that adhere to those standards. Also: "The secretary shall certify only those conforming technologies that are available for licensing on reasonable and nondiscriminatory terms." FACA, a federal sunshine law, does not apply, and an antitrust exemption is included.] Sec. 108: Enforcement The provisions of section 1203 and 1204 of title 17, United States Code, shall apply to any violation of this title as if -- (1) a violation of section 101 or 103(a)(1) of this Act were a violation of section 1201 of title 17, United States Code; and (2) a violation of section 102 or section 103(a)(2) of this Act were a violation of section 1202 of that title. Sec. 109. Definitions In this title: (1) Certified security technology -- The term "certified security technology" means a security technology certified by the Secretary of Commerce under section 105. (2) Interactive computer service -- The term "interactive computer service" has the meaning given that term in section 230(f) of the Communications Act of 1984 (47 U.S.C. 230(f)). [Note: According to 47 U.S.C. 230(f), an "interactive computer service" means "any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions."] (3) Interactive digital device -- The term "interactive digital device" means "any machine, device, product, software, or technology, whether or not included with or as part of some other machine, device, product, software, or technology, that is designed, marketed or used for the primary purpose of, and that is capable of, storing, retrieving, processing, performing, transmitting, receiving, or copying information in digital form." (4) Secretary -- The term "Secretary" means the Secretary of Commerce [Takes effect at the date of enactment, except for sections that wait for federal standard.] Title II -- Internet Security Initiatives [Summary: Creates 25-member federal "Computer Security Partnership Council." Funds NIST computer security program at $50 million starting in FY2001, increasing by $10 million a year through FY2006. Funds computer security training program starting at $15 million in FY2001. Creates federal "computer security awards." Requires NIST to encourage P3P and similar privacy standards] _________________________________________________________________ Penalties summarized (by Declan): Criminal penalties apply to violations of sec. 102 or 103(a)(2). That includes the "interactive computer service shall store and transmit" without removal section, and the distribute "any copyrighted material or other protected content where the security measure associated with a certified security technology has been removed or altered." The criminal penalties are: "(1) shall be fined not more than $500,000 or imprisoned for not more than 5 years, or both, for the first offense; and (2) shall be fined not more than $1,000,000 or imprisoned for not more than 10 years, or both, for any subsequent offense." Only someone who violates the law "willfully and for purposes of commercial advantage or private financial gain" can be convicted. Civil penalties apply to violations of sec. 101 or 103(a)(1). That includes the section talking about how it's unlawful to make systems without security measures, and how nobody may "remove or alter any certified security technology in an interactive digital device." The civil penalties include injunctions in federal court, actual damages, and statutory damages. ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

Re: [cryptography] bitcoin scalability to high transaction rates
by Marsh Ray 06 Jul '18

06 Jul '18

On 07/20/2011 08:24 AM, Ian G wrote: > > Yes, sure, but: > > 1. we are talking about high frequency trading here, and speed is the > first, second and third rule. Each trade could be making 10k++ and up, > which buys you a lot of leaches. > > Basically, you have to get the trade down to the cost of a packet, delay > and two secret key ops. Indeed, if you can measure the delay of the > secret key op, we might be encouraged to pre-calculate shared PRNG > streams so as to speed up the encrypt/decrypt cycle. I once spoke with some engineers who built and run one of those high-speed electronic trading networks/exchanges. Their time to match trades was something like 50 microseconds. Their serious members colocated their trading systems in their datacenter because it was so critical to eliminate the propagation delay. I guess I don't see the need to do bitcoin crypto transactions at that speed any more than the other high-speed exchanges need to rapidly move stock certificates, hard cash, or perform ACH/EFTs. > (Gee I wonder if I should file a patent on that idea :P ) Maybe you could be the next Certicom! ^_^ > This and other aspects of high frequency trading forces a credit > exposure to the trades, which requires someone to step in and control > that credit. But the term "high speed electronic exchange" seems to mean exactly this, almost by definition. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[cryptography] Just how bad is OpenSSL ?
by John Case 06 Jul '18

06 Jul '18

I was recently reading "the most dangerous code in the world" article at stanford: https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html and found the hackernews discussion: http://news.ycombinator.com/item?id=4695350 (interesting discussion and argument about curl library and how often it is badly deployed) And the hackernews discussion led me to "OpenSSL is written by monkeys": http://www.peereboom.us/assl/assl/html/openssl.html So, given what is in the stanford report and then reading this rant about openssl, I am wondering just how bad openssl is ? I've never had to implement it or code with it, so I really have no idea. How long has it been "understood" that it's a mess (if it is indeed a mess) ? How dangerous is it ? It looks like the rant was published in 2009 .... _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

seeking information for Wired News article
by Danit Lidor 06 Jul '18

06 Jul '18

Hi there, I am a reporter at Wired News. We received notice of the upcoming Cypherpunks10th anniversary bash. I am thinking of writing a short article about the history and current status of the cypherpunk community. Obviously, things have changed a lot in the last 10 years. I imagine that you and other cypherpunks would have much to say on the topic. Please feel free to rant and rave to me about whatever you feel would be relevant to this kind of article. When did the Cypherpunks come into existence? Who were the founding members? What was the inital purpose? What kinds of people are involved? Who (socially, i mean, not names!) exactly are the members of the group? How many at any one time? Is it a rotating membership, with people coming and going? There has been a substantial amount of press dedicated to the Cypherpunks, what's been the community response? Have their been internal discussions about the repercussions of the media's involvment and the like? WN has had a very familiar relationship with the cypherpunks - has it been viewed as a positive thing? Have the ideals of the group changed over the years? Are there any manifestos or official statements from the group that I can access? What are the future plans for the cypherpunks? I attempted to access cypherpunks.com but most of the links are dead, why isn't anyone maintaining it? Or is it unrelated to the current community? With whom else are the cypherpunks allied? What do you, personally, have to say about the future of the Internet, privacy, legislation, hacking, phreaking, cyber terrorism, the governement. etc? and finally, who else should I be talking to? Thanks for your time. I am hoping to get the story done before the end of next week (i.e. before the actual party.) Of course, I would never publish the location of the party or any other information that you don't feel comfortable about. Danit Lidor I am also available at 415.276.3925. please leave me a message if I'm away from my desk. I am more than happy to call you back. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0