- cypherpunks-legacy - lists.cpunks.org

Re: Need Mail-to-News gates
by User A. 17 Dec '03

17 Dec '03

You sez: : On Fri, 27 Oct 1995 bluebird(a)alpha.c2.org wrote: : > Could someone PLEASE netmail me some _known reliable_ gates that use the : > straight netmail address format (alt.whatnot(a)bosco.kollege.edu)? : If someone will direct me to sources, I'll try and setup a gate. (We use : INN). 'ftp.hacktic.nl/pub/replay/remailer/mail2news.shar -AJ-

1 0

Re: The John Doe rebellion
by paul.kathro＠insignia.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- azur(a)netcom.com (Steve Schear) wrote: >Eventually, Does could arrange to exchange IDs (if their ages and >descriptions matched) and even credit cards (again assuming equivalence) to >really monkey wrench things. An interesting idea, but how are you going to exchange fingerprints? As far as I can see, the only tangible effect that this scheme would have is to accelerate the call for detailed biometric data (perhaps retinal scans or even DNA profiles) as proof of identity. I'm not sure that we'd want to encourage that... - -- Paul. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMlDQ2ioZzwIn1bdtAQFK8gF/Tugc4AuM+mlkbr663brkmqrPoR86xdu6 WNo5KzQnU6Sb7ywDz83Jq67+NkYMAErx =Y9tO -----END PGP SIGNATURE-----

1 0

Where to find some papers on the the information economy?
by Donald Weightman 17 Dec '03

17 Dec '03

The "World Economy Survey" in the Current ECONOMIST makes some interesting points about the intractabilty of the information-based economy to traditional manufacturing-based econometrics, which looks at things like industrial outputs as the basis for forecasting, and, not least, macroeconomic policy. The gist of it is that the older measures overweight the more traditional transactions -- production & sale of widgets and ingots -- and undercount digital economic activity -- writing code, for example -- because no one knows how to measure the latter. The implications for the political control of cybercommerce are pretty striking -- how can a government control -- using the traditional blunt instruments like fiscal and monetary policy -- sectors it cannot see, measure, or quantify? Anyway, the ECONOMIST Survey cites a couple of papers I'd like to see: Charles Goldfinger; "The Intangible Economy and its Implications for Statistics and Statisticians". Eurostat -- ISTAT seminar, Bologna, Feb. 1996 Danny Quah; "The Invisible Hand and the Weightless Economy". LSE Centre for Economic Performance, occasional paper No. 12, April 1996. I ran some Web searches with null results. Does anyone know how I can get these quickly? Thanks, and apologies if the cross-posting is burdensome. Don Weightman dweightman(a)radix.net

1 0

Re: ASAP letter on e-cash
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Forbes, ASAP, October 7, 1996, p. 18. Bankrupt the Bureaucrats! Eugene Ludwig's principal concern ["The Money Changers," August 26] is not counterfeiting, theft, or fraud: Those crimes have victims, and regulators are never concerned with victim crimes. As comptroller of currency, he is worried sick about tax evasion (i.e., avoidance) and money laundering because he knows that technology like Chaum's Ecash could put him and his entire bureaucracy out of their cushy jobs, regardless of the actions of the executive branch or Congress. Counterfeiting a $100 bill, even one of the new ones, is easier than counterfeiting one of David Chaum's Ecash payments, and the previous level of government "concern" regarding offshore counterfeiting of $100 bills is instructive here (they let it go on for years!!). Some in government have gotten a clue by osmosis, such as Senator Conrad Burns (R-Mont.), but the damage is already done. My solution: Vote Libertarian! Jim Ray liberty(a)gate.net [Right E-steamed Cypherpunk]

1 0

Re: Weaknesses in Smart Cards? (Re: FLA_wed)
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 2:21 AM 9/26/96, Timothy C. May wrote: ... >Strip-back of the outer packaging is possible, of course. I'd need to know >a lot more about the packaging used by VISA and other smartcard makers to >know how economical this would be. (Breaking any single card is not >necessarily a financial windfall, if the card has a limit, for example. >This puts a limit on how much $$$ can be spent on cracking a chip.) As best I can figure, extracting the secret from a Mondex card gives you not merely the money from the card, but the "digital plates" with which to mint arbitrarily much more money. I only say this because the only protocol the I can think of that fits what we do know of Mondex has this problem. This fault does not plague Chaum cash. I don't know how to code the card application so that a transient errors won't just occasionally cause the secret to be exported. Then again that may be possible to code it for "fail safe". If it were my money backing the Mondex cards, I would want to know how it worked.

2 1

Re: How might new GAK be enforced?
by Rick Smith 17 Dec '03

17 Dec '03

Tim May asks: : Any other ideas on how the government plans to enforce GAK, to make GAK the : overwhelmingly-preferred solution? The problem seems somewhat analogous to the software copy protection problem and maybe the enfocement will be similar: make "examples" of a few high profile offenders who are exchanging blatantly un-GAKed traffic with foreigners. This assumes they fine tune the law to make such behavior illegal without having to prove you yourself exported the stuff to them. Wonder what the Supremes will say to that. But that's not the end of the story. If there is lots of GAK encrypted traffic flowing about, then encrypted traffic in general is no longer noteworthy. So as long as your traffic looks like GAK, you won't be hassled until they try to read your traffic. So it's possible that products will appear that use pseudo-GAK protocols -- they look just like their GAKed cousins but the GAK fields contain plausiable garbage instead of keys. It could even turn out to be a vendor "quality control" thing -- oops, the GAK was supposed to work but... You couldn't do that with Clipper (except via Matt Blaze's brute forcing of the LEAF checksum) because the crypto wouldn't decrypt a packet with an invalid LEAF checksum. Since it was a sealed hardware module, implementers had no choice but to play by those rules. There's no such enforcable limitation on commercial software implementations. Rick.

1 0

Re: Export laws don't just affect crypto
by jim bell 17 Dec '03

17 Dec '03

At 12:32 PM 10/1/96 -0400, Perry E. Metzger wrote: > >Lucky Green writes: >> > Umm, so are you violating ITAR if you *use* these GPS-guided missiles >> >> No you aren't. A little known provision in the ITAR excempts exports >> by missile. Seriously. > >Well, not quite -- it exempts exports by space launch, but I think >thats intended for things like satelite launchings and not for things >like missile attacks against other countries... If ITAR exempts exports by missile, does that mean that we merely have to make a model rocket, put a floppy containing PGP in the payload compartment, and shoot the thing over the wall into Mexico, or into Canada? Jim Bell jimbell(a)pacifier.com

1 0

SYN_not
by jya＠pipeline.com 17 Dec '03

17 Dec '03

10-1-96: "Check Point to Provide Safeguard Against TCP SYN Flooding." The new module, now available free of charge on Check Point's Web site (http://www.checkpoint.com) provides protection against this denial of service attack, which has crippled several ISPs in recent weeks. "Certicom Introduces Elliptic Curve Cryptosystem Instruction To Its Security Classroom." It has launched new information about its Elliptic Curve Cryptosystem on the Information Security Classroom section of its web site (www.certicom.ca) "IBM to herd cave-in cats for rat encryption." IBM will be joined by Digital, TIS but few others. An executive at TIS declined to comment on whether it is involved in the IBM cave-in. The company is in a quiet period before making an IPO based on government bribery. "Battle brewing over gov.crypto bribery." Last week, the DARPA announced it has awarded Trusted Information Systems, Inc. a two-year, $1.5 million contract to develop what it calls security wrappers for a Java Prototype System as well as one for the Unix operating system. ----- http://jya.com/synnot.txt (15 kb for 4) ftp://jya.com/pub/incoming/synnot.txt SYN_not

1 0

Re: Clipper III on the table
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:44 PM 10/1/96 -0400, Perry wrote: >We really have to work on cracking DES at least once -- it would >substantially reduce the wind in the Administration's sails. 56 bits + GAK does generally mean DES/GAK, though RC4/56/GAK is also possible. One "56-bit" protocol that might be allowable under the new rules is "something strong with all but 56 key bits revealed", e.g. RC4/128 with 72 bits salt revealed (like the RC4/128 with 88 bits salt revealed that Netscape uses, or 3-DES with 112 bits salt revealed), which would be substantially stronger against cracking than raw 56-bit DES. A big advantage is that it makes pre-computation of lists less useful, since two cyphertexts with the same 56-bit key might be different in the top N-56 bits of key, and the key schedules are less reusable. The 3DES version, for instance, also gains because some of the big DES hooks that let you scrounge a few bits don't work. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/media.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

Re: Clipper III on the table
by jim bell 17 Dec '03

17 Dec '03

At 06:31 PM 10/1/96 -0700, Lucky Green wrote: > > > >On Tue, 1 Oct 1996, Robert Hettinga wrote: >[as to why HP and others support GAK in exchange for DES export] > >> I agree with Lucky's earlier hypothesis that HP's doing this to curry >favor >> for government contracts in lieu of an actual marketing strategy, and I >> leave TIS's motives up to the list as an exercise. ;-). > >This not a hypothesis. A policy person from HP told me that > >1. HP as well as TIS and other companies sell single DES products that >they would like to be able to export. >2. He was directed by HP's marketing department to find a way to make >that happen. >3. He therefore supports a GAK for export "compromise". HP, then, might be a good company to approach as a potential donor on a DES-cracker. While they want to be able to portray their products as reasonably secure, at the same time they want to be able to de-fuse any export limits. Showing that, say, $25,000 of hardware could crack DES in a year (and thus, presumably, $25 million could crack DES in 1/3 of a day, a budget available to the NSA et al.) would demonstrate that there's no strong reason to keep it restricted in any way. Jim Bell jimbell(a)pacifier.com

1 0