- cypherpunks-legacy - lists.cpunks.org

Re: e voting (receipts, votebuying, brinworld)
by anonymous＠remailer.hastio.org 28 Nov '03

28 Nov '03

Major Variola (ret) (mv(a)cdc.gov) wrote on 2003-11-25: > Vinny the Votebuyer pays you if you send a picture of your > face adjacent to the committed receipt, even if you can't touch it. * Voter locks in choice on touch screen. * Paper receipt is printed and shown to voter. * Voter chooses 'great' -> receipt disappears into ballot box Voter chooses 'nope' -> receipt disappears into trash bin / can be taken home as a souvenir. > Since the voting booth is private, no one can see you do this, > even if it were made illegal. (And since phones can store images, > jamming the transmission at the booth doesn't work.) > > You send your picture from the cellphone that took it, along with a paypal > account number as a text message. The intention behind requiring receipts is not to get totally secure voting, but to get oting that is not much more insecure than the current paper process. I assume the 'take pic, show later' attack is also possible against the current system.

1 0

RE: C3 Nehemia C5P with better hardware RNG and AES support
by coderman 28 Nov '03

28 Nov '03

... delayed response > From: Peter Gutmann > "Lucky Green" <[EMAIL PROTECTED]> writes: > >... > >I fail to understand why VIA bothered adding AES support into the CPU. When > >was AES last the bottleneck on a general-purpose CPU? > > Apart from the obvious "what cool thing can we fit in -> <- this much spare > die space?", the obvious target is SOHO routers/firewall boxes. My spies tell > me that it's already being used in a number of products like this, and the > addition of AES will help the process. I am working on a linux distribution that is using the hardware RNG for seeding/rng in number of things (IPSEC, ssh, ssl, gpg, etc) and this is definitely the angle I am excited about. A 1Ghz proc goes a long way, but in a media intensive system (video, audio, streaming over wireless) you want to keep CPU load as light as possible so that latency is minimal. With the C5P you can now do VPN with AES, rng via the hardware entropy, and video offload via the CLE266. This leaves the CPU free to handle various interrupts for the wireless network, disk i/o, etc. Very nice move, I think. I have written some poor code and info regarding the C5XL (nehemiah) and linux: http://peertech.org/hardware/viarng/ [ I'll be cleaning code up and releasing new patches/srcs soon ] > Hardware SHA-1 in the next rev makes > it even better, since you can now do IPsec and SSL tunneling purely in > hardware (and then you lose it all again in the crappy Rhine II NIC, but > that's another story). A lot of peer networking applications use SHA digests for securely identifying resources in a network. The overhead of this for large volumes of content will make this a welcome addition :-) Also, Centaur indicated that with the SHA on die, they can produce statistically perfect RNG output. The von neumann whitener does let a small bias through for very large data sets IIRC (i.e. a statistical bias is detectable in 1G or more data) If you are using the hardware rng via a user space daemon feeding /dev/random then this is no longer an issue. > >The bottleneck tends to be modular exponentiations, yet VIA failed to include > >a modular exponentiation engine. Strange. > > Not for SOHO use it isn't, the initial handshake overhead is negligible > compared to the constant link encryption overhead. The alternative is to do > the crypto externally, for which you're paying for an expensive and power- > hungry crypto core capable of doing a zillion DH/RSA ops/sec that gets used > once every few hours. The alternative is to load or load your standard > firewall firmware into a Nehemiah and offload all the crypto and RNG stuff. I am also curious about crypto-loop file system acceleration / CPU offload. There are a number of uses I am anxious to try with this hardware. Best regards,

2 1

RE: [Asrg] Re: [Politech] Congress finally poised to vote on anti -spam bill [sp]
by Bill Stewart 28 Nov '03

28 Nov '03

At 06:02 AM 11/25/2003 -0800, Hallam-Baker, Phillip wrote: > > Especially for domains, it's important to do some validation, > > though in the absence of widely-deployed DNSSEC, it's hard to > > do automatically. > >DNSSEC is not happening, [...] >We do not need DNSSEC, we just need a notice in the DNS. >It would be a relatively easy task to walk the .com zone >and dump out a list of all the zones which contain a >'do not spam' TXT property record. I suppose you could do that, though it's probably harder to coordinate that for subdomains, whose owners are less likely to be directly managing their DNS records. > > There's a scalability problem that has to be solved, > > which is how to prevent a DOS-by-signing-up-too-many-addresses attack. > >I do not expect that to be a problem, that would be a >problem for the contractor. Limit the number of direct >registrations from a particular IP address within a given >time interval. You'd probably want to do special cases for large domains like AOL, etc., where the users have limited gateways to the internet. You're still vulnerable to DDOS-type attacks by armies of zombies, though of course they've got lots of other bad things they can do. >It is likely to result in the cost of the system being >considerably more than the cost of a couple of mid range >servers and some software. This is not a new phenomena. Too true. It's too bad, because you'd only need a couple hundred million records for the US, and signing up is the only part that's got real-time performance constraints.

1 0

Re: Removing SSZ - Re: Cypherpunks List Info
by Bill Stewart 28 Nov '03

28 Nov '03

At 12:58 AM 10/13/2003 -0700, Billy wrote: >I must ask if this is a bad thing? assuming answer of no now. Whats up >with the BACP meetings? we need to revive them, not that I am trying to >volunteer, but what is the current plan for them? > >Billy >On Sun, Oct 12, 2003 at 11:39:47PM -0700, Bill Stewart wrote: > > Jim Choate recently announced he was closing the SSZ cypherpunks > mailing list. I don't remember if I replied (my personal email system was hosed for a while), but there are some Usual Suspects who'll be in town soon, and we'll probably do some kind of get-together. It may get called a Cypherpunks meeting or it may just be an expedition. Of course, if you or anybody else would like to volunteer, announce a meeting and see what happens, and I'll be happy to help find the pieces of the mail system that the meetingpunks list lives on. Bill

1 0

Re: e voting (receipts, votebuying, brinworld)
by Major Variola (ret) 27 Nov '03

27 Nov '03

At 11:10 PM 11/26/03 +0100, Nomen Nescio wrote: >Cameras in the voting booth? Jesus Christ, you guys are morons. If you >want to sell your vote, just vote absentee. The ward guy will even stamp >and mail it for you. Happens every election. For some reason I don't understand, people actually drive to queue up and vote in a booth on a given day. So that was the model addressed. Personally I vote absentee, so I have plenty of time to photoshop what I fax to Vinny. As well as being able to submit a new blank ballot if Vinny demands to see the original I faxed (but before its mailed in -that is my commit point, just like "opening the curtain" used to be on mechanical voting machines).

1 0

RE: C3 Nehemia C5P with better hardware RNG and AES support
by Major Variola (ret) 27 Nov '03

27 Nov '03

>Also, Centaur indicated that with the SHA on die, they can produce >statistically perfect RNG output. No kidding. With any crypto-quality hash, I can produce statistically perfectly uniformly distributed pseudorandom data from *successive integers*. The von neumann whitener does let >a small bias through for very large data sets IIRC (i.e. a >statistical bias is detectable in 1G or more data) Johnny's whitener removes a particular kind of bias but does not reduce other kinds of regularity at all. Whitening don't mean squat for entropy. (Perhaps you can think of it as spread-spectrum for regularity, if the whitener isn't crypto-secure.) Dataset size is irrelevent except for detectability, you need more samples to be sure that nuances you see are there. >If you are using the hardware rng via a user space daemon feeding >/dev/random then this is no longer an issue. You MUST use some "hardware" (analog) input, and you SHOULD use whitening on the output, and most probably should do other operations in between (mixing partially unbiassed but imperfect input with a pool, for instance).

1 0

Non-Withholding Employer Simkanin Trial Ends: Mistrial (fwd)
by J.A. Terranson 27 Nov '03

27 Nov '03

Note the line: "the Court denied Simkanin the opportunity present any expert defense witnesses or legal evidence". This is what our country has come to. Secret courts; incarceration with no lawyers, trials, or even charges; "trials" where the defendants are prohibited from presenting any evidence; "Sneak & Peek" secret searches... "The Terrorists" have indeed won: they are running this asylum. -- Yours, J.A. Terranson sysadmin(a)mfn.org ---------- Forwarded message ---------- Date: Wed, 26 Nov 2003 10:06:23 -0600 From: "Bob Schulz (DO NOT REPLY - Unmonitored Mailbox)" <LMM-1-141-50433(a)givemeliberty.org> To: measl(a)mfn.org Subject: [We The People] Non-Withholding Employer Simkanin Trial Ends: Mistrial Do not reply to this message -- it was sent from an unmonitored mailbox. If you can't read this, visit http://www.givemeliberty.org/mailroom <http://www.givemeliberty.org/mailroom> to see the message. We respect your privacy. To REMOVE yourself or JOIN our e-mail list, see below. <http://www.givemeliberty.org/> <http://www.givemeliberty.org/aboutus.htm> <http://www.givemeliberty.org/projects.htm> My WTP <https://givemeliberty.org/user/info/mywtp.aspx> <mailto:info@givemeliberty.org> 11-26-03 Employer Simkanin Prosecution Ends in Mistrial Judge Stymies Both Jury & Defense DOJ Intends to Retry Simkanin ASAP Jury Hung at 11-1 Favoring Acquittal After almost 6 months of incarceration in isolation awaiting his federal trial, non-withholding employer Dick Simkanin's trial ended this evening in a mistrial after the jury was unable to reach a verdict on federal charges that Simkanin failed to Withhold taxes from his employees. Simkanin, a successful Bedford, Texas business owner, had been charged with 12 counts of Willful Failure to Withhold employment taxes for his employees and 15 counts of filing False Claims for requesting refunds of tax pre-payments that had been made by Simkanin on behalf of those employees. Facing years in federal prison, his trial lasted only hours, beginning and ending yesterday - largely because the Court denied Simkanin the opportunity present any expert defense witnesses or legal evidence regarding the contested legal obligations under US income tax statutes. Jury deliberations started this morning and the mistrial was declared around 6 PM Central time. Reports from sources close to the Simkanin team was that the jury hung 11-1 in favor of acquittal. (continued...) Click Here <http://www.givemeliberty.org/rtplawsuit/update11-26-03.htm> to read the Full Article Register On-Line Now! Give Me Liberty 2004 The First Annual We The People Foundation & Congress National Conference Washington DC, Thursday-Saturday, January 22-24, 2004 Click Here <http://www.givemeliberty.org/convention/GML2004.htm> to read the Full Announcement _____ GO TO the WTP home page, www.GiveMeLiberty.org <http://www.givemeliberty.org> Join the historic class-action lawsuit <http://www.givemeliberty.org/RTPLawsuit/InfoCenter.htm> against the U.S. Government. Read and sign the Petitions <http://www.givemeliberty.org/FreedomDrive/Redress/SignPetitions.htm> for Redress of Grievances regarding the Government's abuse of its limited war-making, taxing, and monetary powers and its ongoing assault on the Bill of Rights. Click Here <http://www.givemeliberty.org/donations/donate-join.htm> to make a donation and help fund the soon-to-be-filed historic lawsuit and the ongoing efforts of WTP. You have our sincerest Thanks. Our secure, on-line system supports one-time, monthly and twice-monthly e-donations. We support all major credit cards and can process donations from your checking account and PayPal as well. Our subscription-type donations can be stopped or changed by you at anytime either on-line or by request to our offices. We can also process any form of donation via mail. Our mailing address is: WTP 2458 Ridge Road Queensbury, NY 12804. All donations to the WTP Foundation are tax deductible. This message was sent to address measl(a)mfn.org If this is NOT you, you are not on the WTP mailing list. We value and respect your privacy. To unsubscribe from our mailing list, click here: PLEASE DELETE ME <mailto:remove@givemeliberty.org?subject=unsubscribe> If this message was forwarded to you by a friend and you'd like us to send you regular updates, please visit http://www.givemeliberty.org/mailroom/ and subscribe. Already on our list, and want to update your information? Visit http://www.givemeliberty.org/mailroom/. To send an email to Bob Schulz, click here <mailto:bob@givemeliberty.org> . (mailto:bob@givemeliberty.org)

2 1

Re: e voting (receipts, votebuying, brinworld)
by Major Variola (ret) 27 Nov '03

27 Nov '03

At 07:10 PM 11/25/03 -0800, Tim May wrote: >I have no problem with this free choice contract. The only ones allowed to buy votes are the ones running for office. And they are required to do it on credit. "A democracy cannot exist as a permanent form of government. It can only exist until the voters discover that they can vote themselves money from the Public Treasury. From that moment on, the majority always votes for the candidate promising the most benefits from the Public Treasury with the result that a democracy always collapses over loose fiscal policy always followed by dictatorship." --Alexander Fraser Tyler

1 0

RE: [Asrg] Re: [Politech] Congress finally poised to vote on anti -spam bill [sp]
by Hallam-Baker, Phillip 27 Nov '03

27 Nov '03

> Do you have any more details on this for those who don't > normally follow DNSSEC? It is a sad story. Politics and the magic circle. If people are wondering why the major industry players have abandoned the IETF read on. This is only one example of the type, other companies have similar issues. When VeriSign bought Network Solutions one of the main opportunities we saw was to deploy DNSSEC. There is a limit to what you can achieve in the context of DNS, anyone can get a domain name without providing authentication so proving that someone is the legitimate holder of example.com does not mean you want to give them your credit card number. On the other hand it would be quite feasible to deploy a class 1 level assurance system with low cost and ubiquitous coverage. The problem with the DNSSEC specification is the NXT record that links from one signed zone to the next. In the original specification you have to create a link record for every single domain in the zone. This causes the amount of data in the zone to increase enormously. This is fine if you have a typical zone with a few hundred or thousand entries. It is a completely different matter if you are running the dotCOM zone and you have several Gb of zone data already, a contract that specifies a very highl level of reliability and a constant series of DDoS and other attacks going on (about 1000 penetration attempts per day). There is no way that the people with responsibility for running the dotCOM zone are going to deploy a system that has such an immediate effect on operations. The amount of data expands by an order of magnitude. So we proposed a fix. The original security review was performed by myself and Warwick Ford. Instead of linking between every record you only link from one secured zone to the next. This was called 'optin'. This has exactly the same security as the original proposal but the impact on deployment is much less. The cost of deployment scales with the number of people using DNSSEC. The only change in the security is that with OPTIN there is a diferent way that an attacker can perform an insertion attack, that is causing someone to believe a zone is registered when it is not. The attack is not very plausible and at the end of the day the only impact is that we are out the six bucks for the registration. Anyone can insert domains into dotCOM, just see a registrar. The objection to the idea was that this is a VeriSign problem and the WG had zero responsibility for creating a specification that was deployable by the operators of large zones which should not exist anyway. There was also a claim that there was a personality issue, that if proponents of OPTIN had adopted the correct position as a supplicant that their petition might have been considered more favorably. The evidence is against this, every time the go with the flow strategy was attempted the DNS people would call me up six months later and say 'we have been screwed again'. This was understood by virtually everyone in the DNSSEC working group. The chair disagreed. It was at this point that I discovered that the IETF is not open and not inclusive. Every time the working group agreed on OPTIN the specification would be taken on a detour. The first time for consultation in a closed committee called the DNS Directorate. To cut a long story short the plan was filibustered for three years and then after finally comming to last call. After passing last call without objection the chair scheduled two further last calls before we finally came to a result where a clear majority of the group were in favor, four fifths were either in favor or willing to allow it to go forward and two individuals were opposed. So the chair used his perogative to impose his 'consensus' on the group. The result is that OPTIN is on the experimental track, not a proposed standard as the clear consensus of the group was that it should be. This in turn means that it is far more difficult to persuade ICANN to allow deployment of the specification with its experimental status. The IETF was designed the way it is to allow a small clique to hold power while pretending to be open and inclusive. All that Nomcon gumpf is really designed to make it impossible for the nominating committee to make more than a few changes to the IESG each time arround. The result of this type of behaviour is that the IETF has practically no influence in the industry. DNSSEC and IPv6 have been 'about to deploy' for over a decade now. There is still no clue as to how IPSEC works in any application beyond VPN, which is not what it is designed for. SSL makes a better remote access VPN protocol than IPSEC, works through NAT boxes without kludges for a start. The other industry players have similar stories. The industry is taking notice of the ideas comming out of this WG. But they are not very likely to accept a standards process unless it is based on bi-weekly teleconference calls and all major decisions are subject to vote.

1 0

RE: [Asrg] Re: [Politech] Congress finally poised to vote on anti -spam bill [sp]
by pgut001＠cs.auckland.ac.nz 27 Nov '03

27 Nov '03

"Hallam-Baker, Phillip" <pbaker(a)verisign.com> writes: >DNSSEC is not happening, blame Randy Bush and the IESG for refusing the >working group consensus and imposing their own idea that cannot be deployed. >An experimental protocol that increases the volume of data in the .com zone >by an order of magnitude (read Gbs of data) is simply unacceptable. Do you have any more details on this for those who don't normally follow DNSSEC? Peter.

1 0