- cypherpunks-legacy - lists.cpunks.org

Re: HP announcing some International Cryptography stuff on Monday
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:49 PM 11/15/96 -0800, Timothy C. May wrote: >It sounds ominous to me. Another backroom deal, probably for some form of >key recovery strategy, aka GAK. I'd bet GAK too. RSADSI has been working on GAK protocols, so these ones might actually work. I feel as pessimistic about this one as Lucky usually is. At 12:05 PM 11/15/96 -0800, John Gilmore wrote: >Are they the next Big Company to knuckle under to the Feds? Their >pcmcia-with-local-country-surveillance-chip-socket initiative never >seemed to go anywhere. Since I am inherently optimistic, one ray of light may be that the San Jose Mercury News was mentioning the ability to export the system, and then when the necessary licenses (US and foreign) were obtained, turn on the encryption. I guess from this that the encryption is in hardware. Now, software/hardware interfaces are usually fairly simple, so what we have here is a software system with a crypto hook. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

6 5

DSA over Elliptic Curves
by janke＠unixg.ubc.ca 17 Dec '03

17 Dec '03

Has anyone implemented this yet? I am going to and was wondering what good sizes for q (the prime corresponding to the 160 bit prime in DSA) and p (the prime corresponding to the 512-1024 bit prime in DSA) would be? Leonard

1 0

Off the subjects.
by twilley＠juno.com 17 Dec '03

17 Dec '03

Hi all, I am anxious to find an E-mail list forum dealing with financial matters. Possibly, there exists a forum to find a forum. Here in New Jersey there are rumors running about; that 401K's, and other corporation contribution plans are corporate assets: both their contribution, and the monies deducted from your pay, as well as, any other contributions you may have made. In the event of reorganization, in any form, including bankruptcy, these monies are available for redistribution to creditors. Meaning, not us. If true, it's a bit frightening; all and all. Thanks, Twilley.

2 1

Re: Members of Parliament Problem
by Hal Finney 17 Dec '03

17 Dec '03

From: ph(a)netcom.com (Peter Hendrickson) > At 1:39 PM 11/17/1996, Simon Spero wrote: > > Create a number up public/private key pairs, blind them, then do the > > cut-and-choose thing with the security officer. He signs the blinded key, > > then returns it. Unblind the remaining pubic key, and you've got a public > > key with the appropriate signature on it. > > Okay, this would work. But, it requires that all (or at least many) of the > Members of Parliament cooperate. If not, then the security officer will > be able to make very good guesses about who is speaking. > > Parliamentarians may not cooperate for a variety of reasons. They may > not wish to be attacked by terrorists for the words of others. They > may believe that cowardice is not to be encouraged. They may not believe > in anonymity. It might be too hard for them. > > What I would like to see is a method which relies only on published > public keys and no other cooperation from the people who are (more > or less) being used as shields. This may be impossible. The 4th method of Chaum's, from Eurocrypt 91, somewhat satisfies this, as does a method from the Eurocrypt 94 paper. Each person can choose his own public key g**x for a discrete log system. However, the problem is that all members of the group have to choose the same prime p as the modulus, and generator g, for their discrete logs. The issue of using a common modulus in discrete log systems has been somewhat controversial. I think when the government first proposed DSS they planned to do something like this, one modulus with everyone having different secret x values with corresponding public keys y = g**x mod p. This has the advantage that public keys are smaller since everyone uses the same g and p. So all you need is one value for your public key. Without this you have to have g, y, and p be your public key so it is 3 times bigger. The problem is that the way the main discrete log algorithms work, once you have broken one discrete log for a certain g and p you can break all the others very easily. So the particular g,p pair which is chosen for everyone to share becomes one very big, fat target to try to apply discrete log algorithms. Now this is not necessarily as bad as it seems. Unlike the case with RSA, there is no secret information which could be leaked to make solving these discrete logs easier. Nobody knows how to do it. So the only way it can be done is by a massive operation roughly similar to factoring an RSA modulus the size of p. Choosing p of 1000 or 2000 bits should still make it effectively impossible for anyone to do this. The numbers are simply far too large. Still the consensus of opinion with discrete logs is that the advantages of slightly smaller keys have not been great enough to justify the risk involved in having eveyone share a modulus, even though that risk is seemingly insignificant. On the other hand maybe for cases like this the additional advantages to common moduli would be enough to tilt the argument in the other direction. Hal

1 0

Re: Members of Parliament Problem
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:23 PM 11/17/1996, Timothy C. May wrote: >At 11:43 AM -0800 11/17/96, Peter Hendrickson wrote: > For the specific example Peter cites, of a member of Parliament who doesn't > like the possibility of anonymity....well, he wouldn't be part of the > DC-Net would he? Generally, there are no cryptographic solutions that will > encompass the case where some member wants to speak anonymously, but no one > else does. If a message originates from "someone in Parliament," but only > one member of Parliament is set up to speak anonymously, then of course by > simple elimination he is the speaker. As before, this is beyond any > cryptographic solution. It turns out - amazingly enough - that this is not true! Hal Finney mentioned on Friday a paper by Chaum and Heyst entitled "Group Signatures." It was presented at EuroCrypt '91. I scanned this paper today and it has four schemes, the last of which requires no participation of a trusted party or the other people one wishes to hide amongst. So long as everybody has published their public key, the rogue Member of Parliament can sign messages without revealing his identity, yet demonstrating that he is in fact a Member of Parliament. (Thanks Hal!) It uses a zero-knowledge proof. Hal said earlier that it was not clear to him that this could be turned into a non-interactive proof. It isn't clear to me, either. Whatever the case, I consider the problem solved. It would be nice if it were non-interactive, but the rogue MP need only demonstrate his identity to ten or so publicly trusted parties to have enough basis to make statements that the world will consider to be credible. > There may be easier to implement approaches, such as the ones people have > proposed involving distribution of "voting tokens" (blinded, for anonymity). > Anonymous voting is, in fact, formally equivalent (with some hand-waving > about some details) to the problem of untraceable speaking. The example > Peter cited, of a MP wanting to "speak anonymously" is equivalent to > wanting his vote--on Northern Ireland, for example--to be anonymous. I would say that it is slightly different in that anonymous voting requires that you guarantee that each voter votes only once. Clearly these are similar problems. Tangentially, I would really enjoy the privilege of verifiable anonymous voting using my computer. As it is now, I have no way of telling whether my vote counts or not. The entire process is handled by people I don't know and have no particular reason to trust. > A simple form of this is "blackballing." Members have white and black > balls, and place one of the balls in an urn. Properly implemented, this > gives anonymity. I always wondered where that term came from. Chaum and Heyst's protocol above could be used for blackballing in cases where only one black ball can make the decision. For instance, some clubs have a rule that any current member can "blackball" prospective members. (Sounds harsh? Not as harsh as learning that a *majority* of the club didn't like you!) Peter Hendrickson ph(a)netcom.com

2 1

Re: The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 8:38 PM 11/17/1996, Huge Cajones Remailer wrote: >Before we complete your school assignment for you how about letting us >all know the due date and the credit value first. > >On Sat, 16 Nov 1996, Huge Cajones Remailer wrote: > >> Privacy is a hassle. Is it worth it? >> >> Which unfortunate situations does privacy prevent? What are the odds >> that they will occur? How much effort will it take to prevent these >> outcomes? As a model, use the present and future situation of a >> typical reader of this list. Insult is not enlightening. URL? Book?

1 0

No Subject
by Piotr Kunio 17 Dec '03

17 Dec '03

unsunscribe

3 2

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 08:04 ìì 17/11/1996 -0500, Black Unicorn wrote: >> Given that the free market rule is "he who has the money makes the >> rules", please explain how anything less than "subsidized speech" (as >> you put it) is anything close to free speech? >> >> [For those who's assumptions rule their perception: I am *not* arguing >> that all speech should be subsidized. I am merely pointing out that >> the organization that is spending the money to broadcast is >> controlling the speech, hence it is *not* free speech in terms of >> freedom or cost.] >Again, you confuse free speech with free broadcast. Well, I propose a solution to this problem: I don't mind paying fees in fact, if the prices are reasonable. For instance THIS text was _paid_ for, since I pay my Internet provider a certain amount of money every month. It would be unthinkable, however, that my Internet Provider would mess around with THIS text, or with ANY opinion of mine (I am sure you agree). Now, a mailing list has _some_ similarities to the services of an Internet provider, except (usually) the _cost_. I am sure Mr. Gilmore would be more than happy to be _paid_ for the (faulty) services he provides (to his list-members), since e.g. 1900 members times $1 per 2 months (shall we say) would earn him (shall we say) 950 dollars a month; Not much perhaps in some countries, but enough in most places as compensation for the services he provides. The problem with Mr. Gilmore (apart from being an asshole) is really that he is rather a thick-minded proponent of censorship of his list's 'eccentric' members, that such subtleties don't even cross his mind. >Forward complaints to : European Association of Envelope Manufactures >Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern >Vote Monarchist Switzerland "Heaven is a place policed by the English, cheered-up by the the Greeks, and organized by the Germans. Hell is a place organized by the Greeks, policed by the Germans, and cheered-up by the English." ...And what have the noble Swiss got to with this shit? They are the bankers for both! :-) Regards George

2 1

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

The report estimated no such thing..its an urban myth. Give me a citation for the statistic from the report. On Sun, 17 Nov 1996, blanc wrote: > From: Dr.Dimitri Vulis KOTM [cut] > dv: I don't think John Gilmore's sexual practices are *that* bizarre. > The Kinsey report estimates that 10% of the population shares his > practices. > > bw: I guess you think you're talking to someone who gives a flip.

1 0

FC97 Final Call for Papers
by R.Hirschfeld＠cwi.nl 17 Dec '03

17 Dec '03

Financial Cryptography '97 February 24-28 1997, Anguilla, BWI FINAL CALL FOR PAPERS General Information: Financial Cryptography '97 (FC97) is a new conference on the security of digital financial transactions. The first meeting will be held on the island of Anguilla in the British West Indies on February 24-28, 1997. FC97 aims to bring together persons involved in both the financial and data security fields to foster cooperation and exchange of ideas. Original papers are solicited on all aspects of financial data security and digital commerce in general, including Anonymous Payments Fungibility Authentication Home Banking Communication Security Identification Conditional Access Implementations Copyright Protection Loss Tolerance Credit/Debit Cards Loyalty Mechanisms Currency Exchange Legal Aspects Digital Cash Micropayments Digital Receipts Network Payments Digital Signatures Privacy Issues Economic Implications Regulatory Issues Electronic Funds Transfer Smart Cards Electronic Purses Standards Electronic Voting Tamper Resistance Electronic Wallets Transferability Instructions for Authors: Send a cover letter and 9 copies of an extended abstract to be received by November 29, 1996 to the Program Chair at the address given below. The extended abstract should start with the title and an abstract followed by a succinct statement appropriate for a non-specialist reader specifying the subject addressed, its background, the main achievements, and their significance to financial data security. Submissions are limited to 15 single-spaced pages of 12pt type. Notification of acceptance or rejection will be sent to authors no later than January 17, 1997. Authors of accepted papers must guarantee that their paper will be presented at the conference. Proceedings: Proceedings of the conference will be published online in the Journal of Internet Banking and Commerce. Instructions and deadlines for submission of final papers will be sent along with notification of acceptance. Stipends: A very limited number of stipends may be available to those unable to obtain funding to attend the conference. Students whose papers are accepted and who will present the paper themselves are encouraged to apply if such assistance is needed. Requests for stipends should be addressed to one of the General Chairs. Registration: Conference registration and information on travel, hotels, and Anguilla itself is available at URL http://www.offshore.com.ai/fc97/. Workshop: A workshop, intended for anyone with commercial software development experience who wants hands-on familiarity with the issues and technology of financial cryptography, is planned in conjunction with FC97, to be held during the week preceding the conference. For further information, please contact one of the General Chairs. Send Submissions to: Rafael Hirschfeld FC97 Program Chair CWI Kruislaan 413 1098 SJ Amsterdam The Netherlands email: ray(a)cwi.nl phone: +31 20 592 4169 fax: +31 20 592 4199 Program Committee: Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA General Chairs: Robert Hettinga, Shipwright, Boston, MA, USA email: rah(a)shipwright.com Vincent Cate, Offshore Information Services, Anguilla, BWI email: vince(a)offshore.com.ai Conference, Exhibits, and Sponsorship Manager: Julie Rackliffe, Boston, MA, USA email: rackliffe(a)tcm.org Workshop Leader: Ian Goldberg, Berkeley, CA, USA email: iang(a)cs.berkeley.edu Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. Those interested in becoming a sponsor of FC97 or in purchasing exhibit space, please contact the Exhibits and Sponsorship Manager. A copy of this call for papers as well as other information about the conference will be available at URL http://www.cwi.nl/conferences/FC97.

1 0