- cypherpunks-legacy - lists.cpunks.org

Re: Laurie's blinding w/cut and choose?
by Nomen Nescio 06 Jun '02

06 Jun '02

Jason Holt writes: > In his paper on Lucre ("2nd defence" against marking): > http://anoncvs.aldigital.co.uk/lucre/ > > Ben Laurie gives this as a (possibly patent-free) blinding technique, > where h is the message, and g is the public generator: > > r = blind(h) = h^y * g^b (mod p) > > To "sign", > > s = sign(r) = m^h > > To unblind, > > (s/g^k^b)^(1/y) (mod p) > > (where k is the signer's secret exponent. Of course, nobody but the > signer can verify the signature). Unfortunately, this doesn't work with cut > and choose where the signer signs the product of unrevealed documents, since > the 1/y exponent above would distribute to all the internal terms: Boy, you've got a lot of faith asking this question on cypherpunks. It's not exactly the intellectual center of the crypto freedom movement these days, you know. The average IQ is rapidly descending into double digits, even not counting Choate. But let's see what we can do for you. First, let's fix your notation. r = blind(h) = h^y * g^b OK s = sign(r) = r^k, not m^h. unblind(s) = (s/g^k^b)^(1/y) = h^k = sign(h). That's what you want to end up with, h^k, as the pseudo-signature on h. Now for a credential system, you apparently want to create a bunch of values which have some structure, and get a signature on a product of them. Using cut and choose, the client will prepare blinded forms of all of the values, then the server will ask for half of the blinding factors to be revealed. This exposes the raw values to be signed and the server can make sure they are in the right form. If so, it then signs the product of the remaining values, which the client unblinds to get back a good signature on the product of the unblinded values. The fundamental problem with this is that the blinding factors have to be different for each of the values. If they are all the same, then when they are revealed for some of the values during cut and choose, that will reveal them for all of them, and so none of them will be effectively blinded any more. But if the blinding factors are all different, we can't unblind since we don't have a unique power 1/y to raise to. That's your problem, right? Here are a couple of possible solutions. First, you could do a cut and choose in which all but one of the blinded values are revealed, and only the remaining (unrevealed) one is signed. This has the problem that it has only a 1/n security factor with n values. That is, the client can just guess which one the server won't ask to check, and if it sent say 100 values, it has a 1/100 chance of getting lucky, which might seem too high. However since credential issuing usually occurs in a non-anonymous context, you can afford to penalize people very heavily if they are caught in this manner. (Cutting the connection and refusing to resume with the previous values has to count as cheating.) Another approach is as follows. Go back to the 50-50 cut and choose with signature on the product. However, use the same y blinding factor for all of the values. Now when the client has to reveal during cut and choose, it keeps the y value secret but reveals all of the h and b values. It then proves in zero knowledge that there exists a y such that the h^y equals the required value. This is a standard ZK proof of knowledge of a discrete logarithm. It is similar to the example Ben's paper gives of how the bank can prove it is raising to the right power. Since you don't have to reveal y, you can use the same y for all of them and successfully perform the unblind operation, getting back the signature on the product of the h's as required. But actually another solution is much simpler, which is to do blinding as just h * g^b, without a y factor. That works fine as long as the bank is known not to be misbehaving. Ben's paper shows how the bank can use a ZK proof to show that it is raising to the same power k every time, basically again that same ZK proof regarding discrete logarithms. If the bank uses such a proof then you can use simpler blinding without a y factor, and you can recover the signature on the product of your h values by dividing by g^k^(sum of b's). So there you go. A little technical for cypherpunks, but unfortunately coderpunks, like the little old lady, has fallen and it can't get up.

2 1

Slashdot | Using Your Privacy Against You (CC Fraud, e-commerce, terrorism)
by Jim Choate 06 Jun '02

06 Jun '02

http://yro.slashdot.org/yro/02/06/06/0432250.shtml?tid=158 -- -- ____________________________________________________________________ When I die, I would like to be born again as me. Hugh Hefner ravage(a)ssz.com www.ssz.com jchoate(a)open-forge.org www.open-forge.org --------------------------------------------------------------------

1 0

Slashdot | Is China's Control of the internet Slipping?
by Jim Choate 06 Jun '02

06 Jun '02

http://yro.slashdot.org/yro/02/06/06/1225245.shtml?tid=153 -- -- ____________________________________________________________________ When I die, I would like to be born again as me. Hugh Hefner ravage(a)ssz.com www.ssz.com jchoate(a)open-forge.org www.open-forge.org --------------------------------------------------------------------

1 0

Check Out The Lowest Mortgage Rates In 15 Years!
by erika＠bounce.net 06 Jun '02

06 Jun '02

1 0

tracking tech: J. Bell-like vehicle tracker used by locals, malfunctions
by Major Variola (ret) 06 Jun '02

06 Jun '02

Investigators had a list of 20 possible suspects, but Fischer was moved to the top. Detectives said they attached a tracking device to her car, hoping to catch her in the act. On Sunday, more than 30 razor blades were found hidden in Alicia Park in Mission Viejo. Had Fischer been there, the tracking device should have recorded her visit to the park. But the device malfunctioned. http://www.latimes.com/news/local/la-000039747jun06.story?coll=la%2Dheadlin…

1 0

NEW: Unlimited people searches - fast, fun and easy!
by Interesting Products 06 Jun '02

06 Jun '02

1 0

US Mass Market Crypto Exportable
by John Young 06 Jun '02

06 Jun '02

The US Bureau of Industry and Security published today: http://cryptome.org/bis060602.txt (108KB) Revisions and Clarifications to Encryption Controls in the Export Administration Regulations--Implementation of Changes in Category 5, Part 2 (``Information Security''), of the Wassenaar Arrangement List of Dual-Use Goods and Other Technologies SUMMARY: This rule amends the Export Administration Regulations (EAR) to reflect changes made to the Wassenaar Arrangement List of dual-use items, and to update and clarify other provisions of the EAR pertaining to encryption export controls. Consistent with the Wassenaar changes, Note No. 3 (``Cryptography Note'') to Category 5--part II (Information Security) of the Commerce Control List (CCL) is amended to allow mass market treatment for all encryption products, including products with symmetric algorithms employing key lengths greater than 64-bits, that previously were not eligible for mass market treatment. As a result, for the first time, mass market encryption commodities and software with symmetric key lengths exceeding 64 bits may be exported and reexported to most destinations without a license under Export Control Classification Numbers (ECCNs) 5A992 and 5D992, following a 30-day review by the Bureau of Industry and Security (BIS) (formerly the Bureau of Export Administration (BXA)). In addition, this rule, for the first time, allows equipment controlled under ECCN 5B002 to be exported and reexported under License Exception ENC. For all other information security items, including encryption source code that would be considered publicly available, this rule updates and clarifies existing notification, review, licensing and post-export reporting requirements. Restrictions on exports and reexports of encryption items to terrorist- supporting states (Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria), their nationals and other sanctioned persons (individuals and entities) are not changed by this rule. DATES: This rule is effective June 6, 2002.

1 0

Dish Satellite TV Installed FREE in 4 Rooms
by EAASI 06 Jun '02

06 Jun '02

1 0

Miraculous Health productTo Benefit Millions. 7825lbEv2-036uzrd-16
by drinkenergy5573s35＠yahoo.com 06 Jun '02

06 Jun '02

If I could show you how YOU can repair your body from the cellular/DNA level by just drinking water, would you be interested? What if you could hear testimonials from people who are using this product and have seen phenomenal results in a short period of time, simply by drinking this water, providing their body the means to repair itself. Can you take 30 minutes out of your day to LISTEN to a call? Many have reported that simply drinking this water has had a positive impact on degenerative diseases in record breaking times, from cataracts to obesity, diabetes, ulcers, acne, arthritis, high blood pressure, baldness, wrinkles, gray hair, scars, acne, tooth decay, eczema, emphysema, snoring, removes PLAQUE FROM ARTERIES like Chelation therapy, and is great for plants and gardens, as it even keeps grass green in the winter! This product is BRAND NEW to the United States. It was developed out of the country and has been used very successfully for 8 years with a 99% reorder rate. Once you try this product, you WILL reorder! This product is in the beginning stages of sweeping the nation very quickly! Whether or not you are interested in building a business with these products, you MUST try this product for your health. Want to build a business? It doesnt get easier than this. RESULTS! Once you see results, you HAVE to tell others. PLUS, because of the fact that people DO reorder, should you decide to become a distributor, there are NO monthly requirements! AND you will still receive commissions. It doesn't cost to listen, you'll be sorry if you don't. Take a few minutes to change your life NOW! New To The USA! Be First To Join and one of the first to try this miraculous product! Don't Miss Out! For more information, send an e-mail to: bodyenergy4(a)yahoo.com SUBJECT: WATER MORE INFORMATION Thank you! ----------------------------------------- To be removed please send email to delete_mailings4(a)yahoo.com with "Remove" in the subject line Thanks 2395ELTm1-103HbZW4412l20

1 0

Handset Inventory Clearance!
by Carlo Rodriguez 06 Jun '02

06 Jun '02

1 0