- cypherpunks-legacy - lists.cpunks.org

Re: Electronic Banking
by ghsvax!hal＠uunet.UU.NET 30 Nov '92

30 Nov '92

Eric Hughes points out that the blind signatures used to provide anonymity in Chaum's digital cash schemes are patented (by Chaum himself). This is a problem for an official, legal, profit-making business which wants to engage in electronic banking. However, such a business would face many other problems. Chaum's digital cash system could be construed as using the RSA algorithms, since it is in effect an RSA signature which makes the cash unforgeable. So a license for RSA would have to be obtained as well. (RSA licensing would also be needed for secure communication between the bank and its customers.) In addition, the acceptable use policies of NSFNET, which would probably have to be involved in most communications with the bank, are inconsistent with this kind of commercial activity, from what I understand. I believe new policies are in the works to allow commercial activities on the net, but these again will involve licensing costs. There is also the question of the legality of private cash in any form, electronic or otherwise. Nobody seems to have hard evidence on this. On the one hand, people can legally exchange certain types of securities, and they could perform services for each other in return for such exchanges. This is legal, but they are supposed to report the income on their tax returns. Our digital cash would seem to fit this model. (But are such securities transfers as untraceable as digital cash? Perhaps not.) On the other hand, I read several years ago that casino chips in Las Vegas were starting to be used as cash substitutes, but that the government cracked down on this practice. Perhaps this was too conducive to money laundering, especially with the reputed underworld activity in that city. I do think, though, that an informal digital cash system, presented as a research project or an educational game, would be able to slip between the cracks of the legal system, much as PGP has done. And I think this presentation would be legitimate. Digital cash is new (actually, nonexistant, as far as I know), and any use of it would by its very nature be research and be educational. I would suggest that anyone who proposes to implement such a game might want to consider releasing it anonymously (actually, pseudonymously). Sign the release with a PGP or RIPEM key, and let that be your pseudonym. Let people post messages to alt.security.pgp or some other newsgroup to discuss it, so that you can read them without revealing yourself, as proposed by Yanek. Post your replies anonymously using our remailers. This way there won't be a single-point target for anyone wishing to punish users of the game. Hal 74076.1041(a)compuserve.com

2 1

credibility and banking
by Richard Childers 30 Nov '92

30 Nov '92

"If the operators of an escrow service are anonymous, then either their accessible assets had better be enough that you can recover losses if they walk with your goods, or their opportunity cost of defecting on their clients had better be high enough (in terms of lost revenue, lost opportunity on outstanding customer goodwill, name recognition, channels, etc.) that they are sufficiently unlikely to that you will take the risk." It seems to me that there are many parallels between this state of affairs and that which prevailed in the American West of the 1800s, with respect to banking .... there were no agencies insuring deposits, and only the rep- -utation of the bank's president - usually a leader of the community - was guarantee upon the funds. Bank robberies were not uncommon, depositors were few, runs on the bank, I speculate, may not have been unknown in those cir- -cumstances where the community of bank depositors lost confidence in the bank or its officers. Another parallel which occurs to me is that of the computerized trading that occurred when programs controlled trading in, um, was it October of 1987 that the stock market shuddered ? 1989 ? ... it suggests the inevitability of software shuttling funds around at cyberspace speeds to take advantage of ebbs and flows in the economic tides of the human race, around the world ... It would be interesting to further study the origins of banking, as I expect such a study would provide many such parallels by which the case for digi- -tized banking could be made stronger ... -- richard

3 2

USSC Cases Available
by tom.jennings＠f111.n125.z1.FIDONET.ORG 30 Nov '92

30 Nov '92

Cross posted from a local net 125 echo... net access not availble for this system. ----------------------------------------------- | To All Sysops -- You might want to leave an | | announcement advising your users of the | | following. -={lsg}=- | ----------------------------------------------- USSC CASES & Selected Other Legal Decisions Available The PC GFX Exchange BBS in San Francisco has begun building a collection of US Supreme Court and selected legal decisions (eg., Cubby v. CompuServe). The files are PKZIPed and, after their initial upload, will eventually be moved into the board's file directory #64 (Legal & USSC Case Files). The BBS can be reached at the following numbers. 415-337-5416 HST144/v.32bis (public line) 415-337-5599 HST168/v.32bis (downloading for subscribers only) 415-337-6846 HST144 (public line) 415-337-6849 HST168/v.32bis (public line) While the board is an RBBSNet node, regretfully, FREQs are not currently available. PC GFX also carries the FidoNet LAW Echo as well as the LEGAL echos from SmartNet and ILink. A special note of deep appreciation to Mike Riddle and Alec Grynspan for their generous contributions to the file base. -=<Lester Garrett, PC GFX Co-SysOp>=- --- msgedsq 2.1 * Origin: -={The Lyceum}=- San Francisco, CA (1:125/101) -- tom jennings - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!111!tom.jennings INTERNET - tom.jennings(a)f111.n125.z1.FIDONET.ORG

1 0

tutorial needed
by deboni＠diego.llnl.gov 30 Nov '92

30 Nov '92

Howdy! I'm in need of a tutorial text that will bring me up to date on the current methods and terminology in the crypto arena. Any and all suggetions are welcome, and since this is probably an old and tired topic on this list, feel free to mail them to me directly. Thanks! Tom deBoni deboni(a)diego.llnl.gov

1 0

Re: remailers
by fen＠genmagic.com 30 Nov '92

30 Nov '92

[ Marc Horowitz <marc(a)MIT.EDU> writes: ] >People who want to use remailers don't necessarily have the access to >turn their site into one. Far more people use email than are >sysadmins, or friendly with one. [ mark(a)coombs.anu.edu.au (Mark) agrees: ] >What if for instance the user is sending from a student account or some >other limited system (such as a PC) and they either arent allowed to run >nohupped unattended processes or are unable to. Will you deny them the use >of your remailer simply because they cant, or havent the technical knowledge >on how to, install their own remailer? That sounds a bit odd to me.... First, things are changing. More and more people are owning their own machines and setting up their own mail. Heck, I'm planning on having my own internet node at home! Second, we need to proliferate remailers. Get the students running the system to install the code (perhaps for credit!). Or, if you're at a company, explain to the sysadmin that you need to have access to information that is only availble from sources on the other side of remailers, or, perhaps more generally, just indicate that you need connectivity and that not being a remailer cuts down on the number of sites that you can connect to. Finally, perhaps a "student" rating can be added (in addition to "free" and "reputation-based"). Keeping track of the reputations of remailers is a first step to being able to keep track of the reputations of signatures (whether real or pseudonymous). The next step is the active filtering based on such info. Fen

1 0

Re: Secure Key exchange
by pfarrell＠cs.gmu.edu 30 Nov '92

30 Nov '92

Bob Stratton suggests we hash out ideas on key signing prorocols. Ok, here is what I do: I sign keys only when I am certian that the key belongs to the human who claims to have the name on the key. There are not a lot of keys signed by me floating arround, maybe six total. My sig does not mean that the key is not owned by a cop or NSA/CIA/KGB agent (Unlike Edgar's service) because I can't tell. So if you care about that stuff, start your own web of trust with "higher" standards. My sign doesn't mean that the person is really who they claim to be, I can't tell that either. I've signed the key of a guy claiming to be "Ray Kaplan" because I believe that he uses that name reegularly. But I don't know that his name isn't really Boris Badinov. You won't find my sig on Phil Zimmermann's key, even tho that is a popular activity. Phil is a Net/Ether person to me. My sig means that there is a real person with that name. I was at NCSC and exchanged keys there. I'll be at CFP-3 and exchange keys there too. And if you are in my area, (suburban Wash DC) we can meet and exchange keys. I see no reason to hurry. A slowly growing web of trust that is strong is far more useful than an exploding web of trash. Pat Pat Farrell, Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer Write PKP. Offer money for a personal use license for RSA.

5 6

Re: Classified info and other stuff.
by John W Noerenberg 30 Nov '92

30 Nov '92

At 10:44 PM 11/27/92 -0800, John Draper wrote: >Oh, By the way, numerious complaints have been said about the way that >the Mac PGP was stuffed when posted onto "umich'. I will be pushing for >releasing it stuffed with a self extracting archive instead. I also had >problems and lost significant time acquiring the new stuffit in order to >extract it. > >John D. Aladdin makes a freely available unstuffer which reads all their current formats, including self-extracting archives. I found it on their applelink bboard. john noerenberg jwn2(a)qualcomm.com noerenberg.j (Applelink) =========================================================== Do not uselessly lament your luck that is giving way, your work that has failed, your life's plans that have all ended in despair. Like a man long prepared, like a man of courage, bid her farewell, the Alexandria that leaves you. -- "The God Abandons Anthony", Constantine Peter Cavafy [1911] ===========================================================

1 0

Re: Secure key exchange
by edgar＠spectrx.Saigon.COM 30 Nov '92

30 Nov '92

On Nov 26, Mark inquired about "secure" methods of exchanging public keys. Apparently the only really secure method is a physical transfer face-to-face with someone you know; or to have a key certified by someone you trust whose key you trust. [PGP has key certification built-in; for other implementations, just digitally sign some form of the key to be certified]. There is no secure method of exchanging public keys using only the net. As far as you know all your messages, both incoming and outgoing, are being intercepted by a "spoofer" who will substitute his public key for yours in all outgoing messages and another public key of his for each unique public key intercepted in incoming mail. A few methods were discussed on Extropians of trying to get a genuine public key distributed by outsmarting the spoofer. But if the spoofer is smarter than you, these methods will fail. That leaves methods which exchange, or at least verify, keys by other means than the network. I proposed a service to verify keys by paper mail and (optionally) telephone. Here is an update of what I posted. The offer is still good. ================================================================ I'd like to announce the opening of the Swank Public Key Verification Service. To become a customer, do the following. 1)On a piece of paper put: a)Your name and Network address. b)The "armored" ASCii form of your PGP 2.0 Public Key. c)(optional) Any other information you want to certify about yourself, such as: Home address. Mailing address (if different). Home phone number. Occupation-Work Phone-Work Address. "I am not a law enforcement officer or agent." d)"I certify the above to be true under penalty of perjury". e)A photocopy of your driver's license or other picture ID with signature. Actually this is a photocopy of all of the above with the ID on top of the original. [note: if you don't want to reveal your home address, you can cover that portion of your photo ID. Your name, photo, and signature must show] f)Your signature. (NOT photocopied) g)(optional). have the paper notarized. 2)E-mail to me edgar(a)spectrx.saigon.com (Edgar W. Swank) An ASCII message containing Items a) through d). You may encrypt this with my public key (optional). 3)Mail to me at Edgar W. Swank 5515 Spinnaker Dr., #4 San Jose, CA 95123 Via U.S. Mail or alternate such as FedEx: a)The paper prepared as specified above. b)A self-addressed, stamped envelope. This could also be a pre-paid FedEx envelope. It could be addressed to a trusted friend if you're concerned your own mail may be intercepted. c)$1.00 cash (preferred), check, money order, etc. Payment by check will delay processing until check clears. If you don't enclose a self-addressed stamped envelope, enclose an extra $1.00. That all you have to do. Then what I will do for you: I will visually verify that the public key on the paper matches the key I received via E-mail and that the signature on your photocopied ID matches your original signature on the paper. (I do not claim to be a handwriting expert). I will send to you by return E-Mail your public key signed with my public key. I will send to you in the evelope you supplied (or to the address you specify) a paper about myself constructed as described above (but not notarized - if you want notarized send an extra $10). This will give you a verification independent of the network that my public key is really mine. I will post your machine-readable ASCII record that you E-mailed to me to Extropians and Cypherpunks (optional, specify if you DON'T want this). This feature is subject to no objection from Extropians and Cypherpunks list management. I will keep your paper on file for at least one year. Anyone may request a photocopy of your paper (and up to three others) by sending me $1 and a self-addressed, stamped envelope. I will also send your machine-readable ASCII record to his network address, if supplied. Any customer may also phone me directly at (408)227-3471 during reasonable hours and I will verify your/others public key(s) by reading them over the phone. Edgar W. Swank 5515 Spinnaker Dr., #4 San Jose, CA 95123 edgar(a)spectrx.saigon.com (Edgar W. Swank) (408)227-3471 (listed) Cal. Drivers License MO531219 Retired from IBM -- Employee #788281 I am not a law enforcement officer or agent Here is my PGP 2.0 Public Key: --Type bits/keyID Date User ID --pub 1024/87C0C7 1992/10/17 Edgar W. Swank <edgar(a)spectrx.saigon.com> --sig 67F70B Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.03 mQCNAirfypkAAAEEAKe2jziPeFw6hY19clR2GtQ4gtGCSSVOTgPKEJzHfuC74Scf 9PEuu1kebLhHk43A9wo1vr52o4jpH/P/tnFmRtBQOMzLUzAt5rMucswtSVviMQS2 hBuc9yGJKWHVcyfA79EARKEYTdhx+2qKI+hFJcPE+rmD8wVoF94nNf3ah8DHAAUR tClFZGdhciBXLiBTd2FuayA8ZWRnYXJAc3BlY3RyeC5zYWlnb24uY29tPokAlQIF ECsRFxzidd4O/2f3CwEBsmID/2qXL/VdjGxxYFNIZdA+DC6howUXlHw66MUArILE 2/9J69VvcpbQTKmD4A+04SwH9q8SDzWxsg+1VANuy08EE0up9pm7ZBzrxkFcOydh sEwOt9fRn9EJ3tDNYe1SVoxV9Fc47of55Om7cTNrky0hdp1LA13uf/TeV3nrBYa2 1zaz =IFW+ -----END PGP PUBLIC KEY BLOCK----- ====================================================================== Other Options: If you have a listed phone number and request it, I will verify your number through information and call you (collect) to verify the public key you sent me. I will add this as a notation to your electronic and paper record. No extra charge! Another possible option is to use a full color photocopy of your photo ID. This costs about $1.00 at photocopy centers such as Photo Drive-Up as opposed to 5 or 10 cents for an ordinary photocopy. I will also note this on your electronic and paper record. ====================================================================== So far I have zero (0) customers. Philip Zimmerman, in e-mail to me, endorsed the idea, but he has declined to become a customer himself even though I waived the fee for him. Plan B is to exchange/verify public keys face-to-face at parties, such as the PenSFA parties I previously posted info about. Rather than bringing diskettes, I would think printed copies of (armored form) public keys would be easy to handle. I have printed up business-card size copies of *fragments* of my public keys with the 6-hex-digit "Key ID". I think it would be very difficult to generate a valid new key pair where the public key matched the key ID and key fragment. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

3 2

My key policy signed.
by pfarrell＠cs.gmu.edu 30 Nov '92

30 Nov '92

As suggested, here is my key policy signed (not encrypted). It has minor rewordings from my clear text posting of this morning. It and my public key are available via finger. -----BEGIN PGP MESSAGE----- Version: 2.0 owGVVL9rFEEUToKKnm5nIWl8YBPxcjGJIkERlaBoQAKayiLM7b69G252Zp2ZvXOx FTGI/gmKdgER7PwBFnY2YiWCWIggImihqIUSfW/2Ek8E0eVgj5n343vf971dGloY WT+8azST28+Mdq+aj1eGh9+/HBm6e3OufHxh6fu968+e7vi05cGj+5e+fLt96/Om pdnl84cfPpk5sfD6xcSG6MfbrRdXGl8vb96/be7DtSMv36y0b8w+f3dned0rv9HJ ls6V0EP0wP8/J00XsyZamN5dh8mZmamodrotHdAvKyE3SsYlpMYC95G6BfPH5qGD pasDpinGXnYRUmsyDk+ldR4Kh2BSDmxEteOQiRLittAtBOlBavBtyih8YbEOQifQ k0qtRnju3e/qvPCYofacoakWVzNalQFLAAE9uoHjsNhEJbGLixQqQjxf8xCx0d4a pTCBZhkucrTO6KjWaxsCqkWGE9Q7UcjhRq8mN6isxbOFtIRWxDjuzTi/aQIqmBQ0 OQVTYlTDc330NHXeLp2MhQrwuEZbEEEMmBD4nqlgjxHjWqI9FIusYWxrZyCCqTeZ cHCY8Oo6HNg3tXd6X2Nycs/0odhkORFru9igvwdBpJ5EEzyNNAl3ZhwedUJ9BgGh jm2ZezrN0DnRQlLOaSEVCSNVpUDeNhqBUCuCzCz36Vxlk4kKuOnckAe8gXm64FRG TDy5vLKCKoPmQVJtgKPRDuolqVrh12iqB265YHgPAI9qv1EJY8EabKYmQiJdB8iU uaD5d/atEZjORILcWXjyTu65cpcoSstfzqgMQKBp3hIUtsLb9LSLanzPlliLJu8q ITNWMvmjVElFWoUSlvLZ9QEip0c18nleNMnH/UxtPHS06YFMq0xBvqoiQvuesR1e r4IEJF3JWc4VGZK7uN7fisTWmA6JGpucpc15NR3GFkmgFm0Pb6qPK11FVi1QjNbT INzwt4Wp9HXM2gBTtCk8nuOzPp6o9q8fGDbKUWEtKvXvSaeqfWG3rH5wgsg/AQ== =mxji -----END PGP MESSAGE----- Pat Farrell, Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer Write PKP. Offer money for a personal use license for RSA.

1 0

my key signing policy, signed
by pfarrell＠cs.gmu.edu 30 Nov '92

30 Nov '92

As suggested, here is a PGP signed copy of my policy. It and my public key is available via finger -----BEGIN PGP MESSAGE----- Version: 2.0 owGVVL9rFEEUToKKnm5nIWl8YBPxcjGJIkERlaBoQAKayiLM7b69G252Zp2ZvXOx FTGI/gmKdgER7PwBFnY2YiWCWIggImihqIUSfW/2Ek8E0eVgj5n343vf971dGloY WT+8azST28+Mdq+aj1eGh9+/HBm6e3OufHxh6fu968+e7vi05cGj+5e+fLt96/Om pdnl84cfPpk5sfD6xcSG6MfbrRdXGl8vb96/be7DtSMv36y0b8w+f3dned0rv9HJ ls6V0EP0wP8/J00XsyZamN5dh8mZmamodrotHdAvKyE3SsYlpMYC95G6BfPH5qGD pasDpinGXnYRUmsyDk+ldR4Kh2BSDmxEteOQiRLittAtBOlBavBtyih8YbEOQifQ k0qtRnju3e/qvPCYofacoakWVzNalQFLAAE9uoHjsNhEJbGLixQqQjxf8xCx0d4a pTCBZhkucrTO6KjWaxsCqkWGE9Q7UcjhRq8mN6isxbOFtIRWxDjuzTi/aQIqmBQ0 OQVTYlTDc330NHXeLp2MhQrwuEZbEEEMmBD4nqlgjxHjWqI9FIusYWxrZyCCqTeZ cHCY8Oo6HNg3tXd6X2Nycs/0odhkORFru9igvwdBpJ5EEzyNNAl3ZhwedUJ9BgGh jm2ZezrN0DnRQlLOaSEVCSNVpUDeNhqBUCuCzCz36Vxlk4kKuOnckAe8gXm64FRG TDy5vLKCKoPmQVJtgKPRDuolqVrh12iqB265YHgPAI9qv1EJY8EabKYmQiJdB8iU uaD5d/atEZjORILcWXjyTu65cpcoSstfzqgMQKBp3hIUtsLb9LSLanzPlliLJu8q ITNWMvmjVElFWoUSlvLZ9QEip0c18nleNMnH/UxtPHS06YFMq0xBvqoiQvuesR1e r4IEJF3JWc4VGZK7uN7fisTWmA6JGpucpc15NR3GFkmgFm0Pb6qPK11FVi1QjNbT INzwt4Wp9HXM2gBTtCk8nuOzPp6o9q8fGDbKUWEtKvXvSaeqfWG3rH5wgsg/AQ== =mxji -----END PGP MESSAGE-----

1 0