- cypherpunks-legacy - lists.cpunks.org

Q: What's happening in cryptography?
by Eric Fogleman 19 Jan '93

19 Jan '93

I'm interested in finding out what is currently happening in cryptography. My (basement-level) knowledge of it has come from heavy mathematics-oriented texts; these books and articles make it seem as though all of the work in cryptography is done by Ph.Ds at universities. I suspect that's not the whole story... Questions: - What companies, universities are doing work in cryptography? Are there people who get paid to "do cryptography" that don't work for the NSA? If so, where do they work? - Does cryptography fall under mathematics or computer science at most universities? - Are the real developments in cryptographic algorithms coming from the universities, from companies or from cypherpunks? - Any suggestions on what to read, who to talk to, what to experiment with to move up from basement-level knowledge of cryptography? Thanks... Eric Fogleman

2 1

Re: possible solution to the anonymous harrassment problem
by pmetzger＠shearson.com 19 Jan '93

19 Jan '93

> From: Rusty_H._Hodge(a)horizon.amgen.com > > >for example, i can send postal mail with high confidence > >of anonymity, and can make anonymous phone calls (with care, > >e.g., by using phone booths and moving around). > > What about that little old ladie that watches the PO Box and Phone Booth > from her window? What about the postman who sees you place the letter in > the mailbox? Any postman who can distinguish your plain white envelope at a distance from the five thousand other plain white envelopes going into the mailbox likely has sufficient psychic powers that he doesn't need to watch at all. As for the compulsive payphone watchers, well, wear a disguise. Perry

1 0

This Honesty Thing Again
by DrZaphod 19 Jan '93

19 Jan '93

In Message Thu, 14 Jan 1993 12:38:43 PST, horizon.amgen.com!Rusty_H._Hodge(a)netcomsv.netcom.com writes: > If people were totally honest, we wouldn't need such good encryption... I think we've gone over this b4. DrZaphod [AC/DC] / [DnA][HP] [drzaphod(a)ncselxsi.uucp] Technicolorized

1 0

Poor Man's Cash -> Poor Man's Wallet
by Jay Prime Positive 19 Jan '93

19 Jan '93

From: jpp@hermix To: CYPHERPUNKS(a)TOAD.COM In-reply-to: Hal's message of 17 Jan 93 13:47:45 EST <930117184744_74076.1041_DHJ40-1(a)CompuServe.COM> Subject: Poor Man's Cash -> Poor Man's Wallet Here is a minor change which can be used with the Poor Man's Cash protocol to increase the burden on banks which wish to trace transactions. I will call it Poor Man's Wallet protocol. Rather than maintain accounts, have the bank maintain only a map from bills to values. The bank will support three kinds of transactions: Combine, Split, Validate. To check that a bill is good, I ask the bank to VALIDATE b1. It responds with v and b2. V is the value of b1, and b2 is a new bill that has the value of b1 (- bank fee). (Naturaly the new value of b1 will be 0.) Worthless bills b1 could result in either a b2 with a value of 0 (thus issueing a new 0 worth bill) or with no bill at all. To add money to my wallet, I ask the bank to COMBINE a bill b1 from somewhere else, to a bill b2 from my wallet. Both b1's and b2's value get zeroed, and a new bill b3 with value = to v(b1) + v(b2) (- bank fee) is returned to me. To break a bill down to more convinient sizes (perhaps when I wish to pay some one), I ask the bank to SPLIT a bill b1 into b2 and b3, where v(b3) = v(b1) - v(b2) (- bank fee). It may be better (as far as anonymity goes) to require the bank fees be paid with a seperate bill. It will be better to have many banks, and to have the banks each validate bills of other banks. Since in this case your anonymity is the maximum of the anonymities of the chain of banks involved. j'

1 0

Re: possible solution to the anonymous harrassment problem
by Rusty_H._Hodge＠horizon.amgen.com 19 Jan '93

19 Jan '93

>for example, i can send postal mail with high confidence >of anonymity, and can make anonymous phone calls (with care, >e.g., by using phone booths and moving around). What about that little old ladie that watches the PO Box and Phone Booth from her window? What about the postman who sees you place the letter in the mailbox? >privacy and honesty are orthogonal. I've often accidentially overheard things I wasn't suppost to. If people were totally honest, we wouldn't need such good encryption...

2 1

Return envelopes.
by Hal 18 Jan '93

18 Jan '93

I looked at Eric Messick's improved ideas for remailing with digital postage, and they look pretty good. I think it's especially good that Eric has been able to show that anonymous addresses can be used by more than one person without being incriminating. But there is still an attack which they are vulnerable to, which Eric mentions. The "Pneed" field of the anonymous address has information about the postage amounts which will be needed by each remailer in the chain. (But it doesn't reveal which specific remailers to use, of course.) It also has public keys to encrypt these amounts with, which are matched by secret keys hidden in the encrypted address. But the remailers themselves each see their corresponding postage secret keys as they process the message. This means that they know which envelope was used to send each message. That means that each remailer can find out if it is part of a given anonymous address, and it can find out what remailers are before and after it in the chain. It is especially unnerving that the last remailer in the chain can learn this information, as it will see your true address. The one consolation is that it won't _know_ that it is the last remailer in the chain, so it won't realize that it has actually broken the code and is seeing the true correspondance between the anonymous address and the real address. But if most anonymous addresses only go through no more than a handful of remailers, say 10, then that remailer must figure that it has at least a 10% chance of having "broken" your address. This degree of information is more than I would like to have revealed about my anonymous address. Based on this, I would be inclined to use non-postage-charging remailers. But even the non-postage remailers have the same flaw using Eric's protocol. Each remailer sees the "clear text" of the message M being passed along. If a remailer sent the message in the first place, it created M, so if it then sees message M come through later, it again knows the correspondance between an anonymous address and its own forwarding activities. Chaum's scheme avoided this problem by having M get encrypted at each point. Using Eric's notation, an anonymous address might be: Addr: &Z, z, z(&R, r, A, r(junk)) The new addition is A, a random conventional key. Z gets sent: To: &Z Addr: z(z(&R, r, A, r(junk)), pad) Message: z(M, pad) This is just like Eric's example. What Z sends is: To: &R Addr: r(r(junk), pad) Message: r(A(M), pad) The new feature is that Z encrypted M with A as it passed through. In this case we only had a one-step anonymous address, but if there were more than one step, each would use a different conventional key A, B, C, .... This way even a remailer which created M wouldn't recognize it when it passed through after at least one step. Using this idea along with Eric's idea of random padding and double encryption at each step, we have multiple-use return addresses for which no information can be learned at any point about the correspondence between anonymous and real addresses, as long as the return addresses use at least two hops. Hal

1 0

Crypto trading cards.
by Hal 17 Jan '93

17 Jan '93

Giving a little more thought to the idea of buying and selling digital cash, I thought of a way to present it. We're buying and selling "cryptographic trading cards". Fans of cryptography will love these fascinating examples of the cryptographic arts. Notice the fine way the bit patterns fit together - a mix of one-way functions and digital signatures, along with random blinding. What a perfect conversation piece to be treasured and shown to your friends and family. Plus, your friends will undoubtedly love these cryptographic trading cards just as much. They'll be eager to trade for them. Collect a whole set! They come in all kinds of varieties, from the common 1's, to the rarer 50's, all the way up to the seldom-seen 1000's. Hours of fun can be had for all. Your friendly cryptographic trading card dealer wants to join the fun, too. He'll be as interested in buying your trading cards back as in selling them. Try this fascinating and timely new hobby today! Hal

1 0

Poor Man's Cash.
by Hal 17 Jan '93

17 Jan '93

Tim May's message about remailers mentioned the possibility of a simple way of handling digital postage. This can be extended to be a replacement for digital cash which doesn't use any cryptography. As in Tim's suggestion, the "banker" (or "money changer" in the model I described yesterday) simply creates 50-bit numbers, each of which is a "piece of digital cash". The banker keeps a list of the specific numbers that are circulating. When someone presents one for payment, he checks to see if the number is on the list. If so, he honors it and then removes it from the list. As with regular digital cash, withdrawers keep the numeric values secret. Nobody can forge the cash because no one can create numbers which are on the banker's (secret) list. There are two problems with this system. The first is that there is no way for the seller in a seller/buyer transaction to verify that the random 50-bit numbers the buyer is offering him are actually valid pieces of digital cash. The only thing he could do is to send them to the bank and have the bank report back as to whether they are valid or not. But in at least the simpler cryptographic protocols, the same problem exists. In those protocols, it may be possible to use digital signatures to recognize that a particular piece of cash originally came from the bank, but you still have the problem that this cash may have been "spent" before. Digital cash can be reproduced trivially, so any seller must again check with the bank to make sure that the cash he is offered is still valid. (More complex schemes are intended to allow "incrimination" of a buyer who reuses cash, but I feel that they have problems as well.) So this problem is no worse than at least the simpler cryptographic schemes. The other problem is that this cash is not anonymous. When a seller sends in some cash he received from a buyer, the banker can recognize which buyer that cash came from. But there are several reasons why this might not be as bad as it seems. First, the buyer and seller may themselves be anonymous to the bank. The bank may know them only through an anonymous address of the type we have been discussing here. So, at best, the banker could deduce things like "account 1234 seems to be buying a lot from account 5678." This is not a direct loss of anonymity. Second, our own paper cash already has this problem, through the serial numbers printed on each bill. Although this is used occasionally by law enforcement to track criminals, it is not considered in general to be a threat to anonymity. And third, the banker could have a policy of not remembering which buyer received each outgoing digital cash number. This could be done by having the banker publicize the software which he is running, so that people can see that these records are not being kept, along with occasional audits by some third party to verify that the banker is actually running that software. There would still be an element of trust involved, but trust will always be a part of such relationships, and reputations will be important. This "poor man's digital cash" is not that interesting technically, because no cryptography is involved. But it does provide most of the features of crypto-cash, and it does so in a manner which is easy to understand and explain. It also violates no one's patents, so it would be that much easier to start experimenting with it safely. Hal

1 0

No Subject
by k.campbell14＠genie.geis.com 17 Jan '93

17 Jan '93

i want to join the revolution. return to bablon. appreciated...

1 0

Digital cash legality...
by Hal 17 Jan '93

17 Jan '93

I've continued to try to learn about what laws might restrict the issuing of electronic money. Banking is controlled at both the state and the federal level. One question was whether one could engage in bank-like activities without calling yourself a bank. Denning's California Codes, Financial, has this definition: ------ Section 102. "Bank" The word "bank" as used in this division means any incorporated banking institution which shall have been incorporated to engage in commercial banking business or trust business. The soliciting, receiv- ing, or accepting of money or its equivalent on deposit as a regular business shall be deemed to be doing a commercial banking business whether such deposit is made subject to check or is evidenced by a certificate of deposit, a passbook, a note, a receipt, or other writing; provided, that nothing herein shall apply to or include money or its equivalent left in escrow, or left with an agent pending investment in real estate or securities for or on account of his principal. It shall be unlawful for any corporation, partnership, firm, or individual to engage in or transact a banking business within this state except by means of a corporation duly organized for such purpose. ------ This seems to say that it's illegal to do these bank-like activities unless you either are a corporation specifically chartered to be a bank (in which case the many banking laws apply to you), or unless you are an escrow agent or a real estate or securities agent (in which case many other laws apply to you). The California financial codes are three volumes long, so there is a considerable body of law that one would have to be familiar with to consider engaging in such activies. Another approach I have thought of would be to buy and sell digital cash, calling it something else. It's legal to buy and sell other bit patterns, such as computer-readable pictures and software, so it should be legal to buy and sell these cryptographic items. The idea would be that for $1.00 you will sell someone a #1.00 crypto- cash file, either through email or over the counter if you wanted (on a floppy). Then, if someone comes to you with one of these #1.00 digital cash files, you will buy it back for $1.00. At one level you are simply buying and selling items just like the local dealer in baseball cards, but at another level you are a "money changer", converting between U.S. dollars and crypto-credits. The credits thus receive backing through your willingness to redeem them for dollars at any time. One issue is how certain people can be that you actually will buy back this crypto-cash for its "face value". Given that you're not actually a bank, not actually a money dealer, and therefore not bound by any regulations, there is nothing to compel you to continue to accept the crypto money. You could arbitrarily decide at any time not to buy it back any more, just like the local baseball card dealer. This, I think, is what makes this whole activity legal - you're not making any promises to "depositers" that they can get their money back. But, by the same token, it may prevent the digicash from being accepted. It would basically come down to your reputation for being trustworthy and committed. Another problem is the issue of sales tax. Using this "seller of bit patterns" model, you will have to collect sales tax from your customers who are within the state. From my experience selling software, you don't have to collect it for out-of-state customers. I don't know whether the state would also expect another "cut" when you buy the bit patterns back. But it sounds like there will be at least a 7% transaction cost to turn dollars into digital cash, which is probably prohibitive. One solution might be to do this from a state which doesn't collect sales tax. (Coin dealers here in California have some exemptions from the sales tax requirements, but I doubt whether these exemptions could be stretched to cover what I am proposing here. In other respects, though, that business is rather similar to what I am talking about, in that they do a lot of selling and buying back.) A related issue is whether this should be thought of as a business at all, or whether it could be a hobby. The fact is, you could actually make a lot of money at this, even though you buy and sell at the same price, by investing the dollars you are paid until you have to use them to buy the digital cash back. Still, given the apparent need to infringe or license both RSA's and Chaum's patents, I think running it on a "non-commercial" basis would be more acceptable, if that could be done. I suppose if you were careful to segregate the dollars used to purchase crypto-cash into a non-interest-bearing account, so you didn't make any money on them, you could call it non- commercial. (Actually, it's not 100% clear to me that RSA's patents would apply to a digital cash implementation, since their patent is for a communications machine, even though the algorithm is the same.) I'll let people know as I continue to learn more. Hal

1 0