- cypherpunks-legacy - lists.cpunks.org

NPR is talking about smart card purses...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by rah(a)shipwright.com (Robert Hettinga) on Wed, 10 Apr 5:53 PM >Chase, Citi, MC and others are offering a stored value >card on the west side of Manhattan. They're saying >that smart cards are faster than cash. Stick the card >in, say yes to the amount. The terminals are wired >directly to a bank account, so we're looking at a book >entry system, it looks like... > >The announcer is breathless at the possibilities.... > >I wonder if this is CAFE, Mondex, or what? anyone >know? ---------- Yep, NYT has a story on it today, the testrun is in my own pigsty. It's by Citibank, Chase Manhattan, Mastercard and Visa: electronic cash loaded on a plastic card that can be used to make small purchases. The article also reviews the state of the art. Wanna see it from me, or try http://www.nytimes.com?

1 0

Re: Protocols at the Point of a Gun
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:48 PM 4/10/96, Duncan Frissell wrote: >Well this is as good a time and place as any to ask the question that >none of the opposition seems to have asked (perhaps because they don't >know enough to ask): How do you force geographically dispersed nodes >on a distributed network to adopt a set of officially mandated protocols? > >But first a reading assignment: "How Anarchy Works--Inside the Internet >Engineering Task Force" from Wired. > >http://www.hotwired.com/wired/3.10/departments/electrosphere/ietf.html I'd also recommend Michael Froomkin's article "The Internet as a Source of Regulatory Arbitrage," available at http://www.law.miami.edu/~froomkin/arbitr.htm It gets into the nature of IETF-type stuff, especially vis-a-vis the difficulty jurisdictions have in enforcing parochial rules. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Know Your Net.Enemies Project
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Would anyone be interested in collaborating on a "Know Your Net Enemies" project? We'd start with a resource like Bob Chatelle's excellent web pages at <http://world.std.com/~kip/bcfenatl.html> and with permission build on it and list the deceptions and misrepresentations each Net-Enemy has engaged in -- what each has done to restrict liberty online. We'd include original documents and links as appropriate. Who would be listed? Well, there's the family values groups [AFA/CC/NLC/EE!/FOF/FRC], the green card spammers, Carnegie Mellon University, Marty Rimm, the Church of Scientology, the Simon Wiesenthal Center, the NSA, German state prosecutors, Senator Exon, Dorothy Denning, and so on. If each collaborator takes a particular group or person, this could be done relatively quickly. Then we'd put it online at EFF's web site, with prominent treatment. All contributors would receive full credit for their work, of course. Anyone interested? This would be a great resource. -Declan

1 0

Re: No matter where you go, there they are.
by Peter Trei 17 Dec '03

17 Dec '03

> > Peter - didn't they say that the checking station is also listening > to the satellites? That way they can tell that you are playing back > signals that you taped earlier because they won't match what the > satellites are broadcasting right now. > > I think your idea would work if you wanted to pretend to be at a point > which was _farther_ from each of the satellites than where you actually > are. Then you could delay all of the signals. But the only way to > be farther would be to be deep underground. You might be able to pretend > to be at the center of the earth, but that is not very useful. > > Actually I suppose this only applies to those satellites which are shared > between you and the checkin station. If you are far away then maybe you > only share one or two. If you know which ones those are, you can lie to > your heart's content about other ones, and for the shared ones you can > again delay the signal and claim to be farther than you are. > > If their authenticated repeaters are used then you have to assume the > checking station has all the satellite signals and again the best you can > do is pretend to be a Mole Man. > > Hal Denning hasn't thought this through. Do the math. The diameter of the earth is 12,576 km The speed of light is about 3e5 km/sec -> max phase shift to simulate = 42 msec. This is on roughly the same scale as network delays, or less. If you are trying to simulate a location in roughly the same area as your actual location (say, on the same continent), the max phase shift to simulate is a lot smaller - probably less than 5 ms. The site checking the incoming packets for their origin has to allow for realistic network delays - say 100 -200 ms. Therefore any site that can see the same set of satellites as the site it is trying to simulate can do so, buffering less than 50 ms of waveforms and pretending to be on the end of a slow link. Denning's plan: A beautiful idea murdered by cold, unfeeling facts. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Re: No matter where you go, there they are.
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>From: hfinney @ shell.portal.com (Hal) @ UGATE >Peter - didn't they say that the checking station is also listening >to the satellites? That way they can tell that you are playing back >signals that you taped earlier because they won't match what the >satellites are broadcasting right now. > >I think your idea would work if you wanted to pretend to be at a point >which was _farther_ from each of the satellites than where you actually >are. Then you could delay all of the signals. But the only way to >be farther would be to be deep underground. You might be able to pretend >to be at the center of the earth, but that is not very useful. No, the situation is better than that. Here's how GPS works (loosely): you have four unknowns (not three): x, y, z, and the current time. You have signals from four satellites reporting their x, y, z, t. Using suitable math you construct four equations in four unknowns, and presto, you get your four answers. Why is time one of the unknowns? Because your receiver only has a rough idea of what time it is. Remember that a microsecond offset amounts to a 300 meter (1000 foot) displacement. So a side effect of GPS position measurement is accurate time measurement. (Some GPS receivers turn this around, and make delivering accurate time their primary task. They get accurate position as a side effect.) Suppose I want to pretend that I am 1000 feet closer to satellite 4 than I really am. Simple, I take the signals from all the other satellites and delay them by 1 microsecond. That looks like a 1 microsecond local timebase error together with a 1 microsecond delay reduction to satellite 4. Yes, the checking station in this purported scheme would also listen to the satellites. That doesn't help at all. It could detect that I replayed a signal from a minute ago (unless I substitute the correct time codes, which wouldn't be hard since they are predictable). But there is no need to do that and indeed it's probably easier not to. In the description of the article, the "signature" [sic] is sent to the checker over some sort of comm link, which has a latency likely to be several milliseconds or more, plus jitter of many microseconds. If I'm a healthy distance away from the target (say, 20 miles) that means I have to introduce an offset of at most 100 microseconds. If I do that in real time -- which is no big deal -- then the checker basically has to be capable of detecting 100 microsecond delays in the authentication data it is getting. And if I'm willing to be closer to the lion's den -- say, a block or two away -- then I only need at most a one microsecond delay. Incidentally, differential GPS is not an issue (re Peter's question). GPS relies on knowing accurately the position and time at each satellite and the speed of light in between. DGPS lets you correct for errors in these. The idea is simple: if you're close to a "reference station", then the errors are essentially the same for both. The reference station is at a precisely known place, so it can look at where the satellites claim it is, and deduce from that how much error there is on the signal from each satellite. It tells you, and you subtract out those errors. So while DGPS lets you get better accuracy, it doesn't interfere with your ability to fool the CyberLocator scheme. paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning(a)isd.3com.com or paul_koning(a)3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "Be wary of strong drink. It can make you shoot at tax collectors ! -- and miss!" ! -- Robert A. Heinlein, "The Notebooks of Lazarus Long" ! in "Time Enough for Love"

2 1

Re: No matter where you go, there they are.
by Powers Glenn 17 Dec '03

17 Dec '03

- It's called "S/A" (Selective Availability) which is the NWO term for adding - errors that "authorized" users can remove. (Not to be confused with A/S, or - anti-spoofing) It was originally intended to be turned on in wartime to - deny the enemy accurate fixes, but during the Gulf War military GPS - receivers were so scarce that the soldiers had to use commercial products, - so the S/A actually was turned OFF then! - - Since then, pressure has been building to turn off S/A, since its usefulness - is nearly zero. Even so, the amplitude of S/A errors are only a little - larger than natural errors caused by satellite timing errors, atmospheric - propagation variations, etc. The result is that DGPS is useful, which is - (more or less) a fixed antenna and GPS system which knows where it is, and - subtracts where it "seems" to be by GPS every second, and broadcasts the - resulting error data on some terrestrial system to receivers locally. The - result is errors down to the 1-meter level and even lower. That system - compensates for both natural errors and S/A, so the whole purpose of having - S/A is negated. Eventually S/A will probably be turned off permanently, but - even then we'll want to continue to use DGPS systems. Close, but not quite: S/A is an ADJUSTABLE variable, not on/off. it can reduce accuracy to 10 meters or 100 meters or whatever. It's a DoD term, not NWO term. The "this is where you really are" percision location (forgot the designation off hand) is ENCRYPTED (yes, there is crypto revelance here...) in the data stream from the satellites. The difference S/A makes is on the order of magnitude, therefore not "useless." It should be pointed out that different regions of the earth can have different degrees of accuracy based on the S/A system. I doubt S/A will ever be turned off, but this is my opinion. I know Jim's opinion. Discussion of this point is pointless. DGPS transmission are made from a multiple single points, which (to the best of my knowledge) are not networked. glenn

1 0

Pub Key patent update
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

The battle over the public key patents continues, with no end in sight. Recent events: * Cylink tried to get a preliminary injunction against RSADSI shipping BSAFE for contributory infringement of the Stanford patents. The judge denied it, saying there was doubt about the validity of Diffie-Hellman and about the scope of Hellman-Merkle. * Cylink is appealing the preliminary injunction denial to the Federal Circuit. * Cylink's lawsuit to break the MIT RSA patent on obviousness and other grounds is scheduled to goto trial on July 9 before an LA judge. I don't know where the trial will be held. * RSADSI had a license to the Stanford patents dating back to around 1987, and it argues that it covers BSAFE customers. Cylink recently demanded a 5% royalty, and when RSADSI refused, Cylink unilaterally terminated the license. Cylink is now adding a direct infringement claim against RSADSI. * RSADSI and PKP motions for dismissal of my charges have left most of them intact. In particular, the antitrust charge is still alive. * My motion for summary judgment on the invalidity of the patents is technically still pending, but the judge shows no sign of ruling anytime soon. If my arguments were either clearly correct or clearly incorrect, he would have ruled by now. I cannot predict what will happen. * Trial on the Stanford patents is likely this summer. RSADSI is trying to postpone it. Roger Schlafly phone: 408-476-3550 CompuServe: 76646,323 US Mail: PO Box 1680, Soquel, CA 95073 USA Internet: rschlafly(a)attmail.com

1 0

Re: Digital Cash Escrow
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:27 PM 4/11/96, Vladimir Z. Nuri wrote: >give me a break!!! the future government attempts to squelch, >suppress, restrict, prohibit, regulate, tax, spindle, and >mutilate Digital Cash will make Clipper look as significant and >threatening as a christmas tree ornament. Larry, are you just _now_ realizing these implications? A few years ago you were fairly dismissive of these effects, arguing mainly that "electrocrisy" (electronic democracy?) would be the main effect, or at least the program that Cypherpunks should push. ... >as I wrote in an earlier essay, the possibilities of combining >digital cash with stock market company shares suggest a radical >new economy that would have the potential to topple a lot of >very powerful existing interests, in the way that printing presses >once toppled the Church. > >to borrow a bit of Chinese black humor, "we live in interesting times". >we will be living in even more interesting times shortly. Sure. I wrote essays along these lines as early as 1987, with the ideas apparent to me even earlier. (Cf., for example, "The Crypto Anarchist Manifesto," 1987.) Glad you are finally tuned in to our channel. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: GPS-based authentication
by jim bell 17 Dec '03

17 Dec '03

At 11:33 AM 4/11/96 -6, Peter Trei wrote: >Ms Denning, Mr. MacDoran > >I've read with interest your proposed GPS-based authentication >mechanism (it was posted to the cypherpunks mailing list). Can you >confirm that you wrote this? Some people on the list think it may be >a forgery. > >The participants of the list have noted some apparent vulnerabilities >in the system, and I am curious as to how you address them. If you >respond to me and give permission, I'll forward your response to the >list. > >The problems are two-fold: > >1. The system is easily spoofed. >2. It leaks sensitive location data. It should occur to all of us that what you (and we) call "problems" are, to government sympathizers, actually FEATURES. Identifying people's locations is probably going to be considered enormously important to the government (if it lasts that long). And since the government runs all the GPS transmitters, and can presumably modulate the S/A function any way it wishes, it has a leg up on all of us who have to depend on the integrity of the system. There is also the possibility of them jamming the system locally to either deny the user the ability to make the identification system work and thus deny access, or detect the location of the user by subtly modulating the local signal in such a way as to leak through the otherwise-secure system. (If we trust it that far, which I don't.)

1 0

Entropy Estimator
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

I just added a feature to my entropy graphing program that estimates the number of bits of entropy in the file, in addition to making the graph. I tested it on some ZIP files, comparing the sum of the results obtained from each file individually to the results from the ZIP file containing all of them. So far, the results have been consistent within 20%. EXE's show 3-4 entropy bits/byte, ZIP files show 6-7, and DLL's and text files show 1-2. Source code (Visual Basic) available to anyone who wants it, but I think I will hold off on the EXE and VBX's until I find someone who will put it on their FTP/WEB site. Suggestions via email regarding this would be appreciated. Jonathan Wienke

1 0