- cypherpunks-legacy - lists.cpunks.org

RE: I'll show you mine if you show me, er, mine
by Whyte, William 03 Mar '05

03 Mar '05

I haven't read the original paper, and I have a great deal of respect for Markus Jakobsson. However, techniques that establish that the parties share a weak secret without leaking that secret have been around for years -- Bellovin and Merritt's DH-EKE, David Jablon's SPEKE. And they don't require either party to send the password itself at the end. William > -----Original Message----- > From: pgut001(a)cs.auckland.ac.nz [mailto:pgut001@cs.auckland.ac.nz] > Sent: Wednesday, February 23, 2005 7:30 AM > To: cryptography(a)metzdowd.com; cypherpunks(a)al-qaeda.net; > rah(a)shipwright.com > Subject: Re: I'll show you mine if you show me, er, mine > > > "R.A. Hettinga" <rah(a)shipwright.com> forwarded: > > >Briefly, it works like this: point A transmits an encrypted > message to point > >B. Point B can decrypt this, if it knows the password. The > decrypted text is > >then sent back to point A, which can verify the decryption, > and confirm that > >point B really does know point A's password. Point A then > sends the password > >to point B to confirm that it really is point A, and knows > its own password. > > Isn't this a Crypto 101 mutual authentication mechanism (or at least a > somewhat broken reinvention of such)? If the exchange to > prove knowledge of > the PW has already been performed, why does A need to send > the PW to B in the > last step? You either use timestamps to prove freshness or > add an extra > message to exchange a nonce and then there's no need to send > the PW. Also in > the above B is acting as an oracle for password-guessing > attacks, so you don't > send back the decrypted text but a recognisable-by-A > encrypted response, or > garbage if you can't decrypt it, taking care to take the same > time whether you > get a valid or invalid message to avoid timing attacks. Blah > blah Kerberos > blah blah done twenty years ago blah blah a'om bomb blah blah. > > (Either this is a really bad idea or the details have been > mangled by the > Register). > > Peter. > > > --------------------------------------------------------------------- > The Cryptography Mailing List > Unsubscribe by sending "unsubscribe cryptography" to > majordomo(a)metzdowd.com

1 0

I'll show you mine if you show me, er, mine
by R.A. Hettinga 03 Mar '05

03 Mar '05

<http://www.theregister.co.uk/2005/02/21/crypto_wireless/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Identity ; Original URL: http://www.theregister.co.uk/2005/02/21/crypto_wireless/ I'll show you mine if you show me, er, mine By Lucy Sherriff (lucy.sherriff at theregister.co.uk) Published Monday 21st February 2005 17:11 GMT Security researchers have developed a new cryptographic technique they say will prevent so-called stealth attacks against networks. A stealth attack is one where the attacker acts remotely, is very hard to trace, and where the victim may not even know he was attacked. The researchers say this kind of attack is particularly easy to mount against a wireless network. The so-called "delayed password disclosure" protocol was developed by Jakobsson and Steve Myers of Indiana University. The protocol allows two devices or network nodes to identify themselves to each other without ever divulging passwords. The protocol could help secure wireless networks against fraud and identity theft, and protect sensitive user data. The technique will be particularly useful in ad-hoc networks, where two or more devices or network nodes need to verify each others' identity simultaneously. Briefly, it works like this: point A transmits an encrypted message to point B. Point B can decrypt this, if it knows the password. The decrypted text is then sent back to point A, which can verify the decryption, and confirm that point B really does know point A's password. Point A then sends the password to point B to confirm that it really is point A, and knows its own password. The researchers say that this will prevent consumers connecting to fake wireless hubs at airports, or in coffee shops. It could also be used to notify a user about phishing attacks, scam emails that try to trick a user into handing over their account details and passwords to faked sites, provide authentication between two wireless devices, and make it more difficult for criminals to launder money through large numbers of online bank accounts. Jakobsson is hoping to have beta code available for Windows and Mac by the spring, and code for common mobile phone platforms later in 2005. More info available here (http://www.stealth-attacks.info) . Related stories Hotspot paranoia: try to stay calm (http://www.theregister.co.uk/2005/01/24/wi_fi_hotspot_security/) Crypto researchers break SHA-1 (http://www.theregister.co.uk/2005/02/17/sha1_hashing_broken/) Cyberpunk authors get the girls (http://www.theregister.co.uk/2005/02/17/cyberpunk/) ) Copyright 2005 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

6 5

With Terror in Mind, a Formulaic Way to Parse Sentences
by R.A. Hettinga 03 Mar '05

03 Mar '05

<http://www.nytimes.com/2005/03/03/technology/circuits/03next.html?8cir=&pag…> The New York Times March 3, 2005 WHAT'S NEXT With Terror in Mind, a Formulaic Way to Parse Sentences By NOAH SHACHTMAN MAYBE sixth-grade English was more helpful than you thought. One of the dullest grammar exercises is being used to help find potential terrorists, and save companies a bundle. Diagramming sentences - picking out subject, verb, object, adjective and other parts of speech - has been a staple of middle and high school grammar lessons for decades. Now, with financing from the Central Intelligence Agency, a California firm is using the technique to comb through e-mail messages and chat room talks, which can be a rich lode of corporate and government information, and a tough one to mine. Figuring out the connections among people, places and things is something computer algorithms do pretty well, as long as that information is structured, or categorized and put into a database. Looking through a company's customer file for a person named Bonds, for example, is fairly simple. But if the data is unstructured - if the word "bonds" hasn't been classified as the name of a ballplayer or as an investment option - searching becomes much more difficult. For people in business or in public service, only 20 percent or so of their information is kept in formal databases, noted Nick Patience, an analyst with the 451 Group, a technology research firm. The rest is unstructured, tucked away in e-mail messages, call logs, memos and instant messages. Attensity, based in Palo Alto, Calif., and financed in part by In-Q-Tel, the C.I.A.'s investment arm, has developed a method to parse electronic documents almost instantly, and diagram all of the sentences inside. ("Moby-Dick," for instance, took all of nine and a half seconds.) By labeling subjects and verbs and other parts of speech, Attensity's software gives the documents a definable structure, a way to fit into a database. And that helps turn day-to-day chatter into information that is relevant and usable. "They take the language that people use every day and compile it in a way that a machine can use," Mr. Patience said. "And that allows people to start using this tremendous amount of intelligence which has gone untapped." Whirlpool, the home appliance manufacturer, is now using Attensity software to help cull information from the 400,000 customer service calls the company receives each month. Tom Welke, a Whirlpool general manager, said the company realized it needed help in March 2002, during a microwave oven recall. The machines were arcing, producing electrical sparks, which caused the food inside to smoke. Mr. Welke decided to pore through records of recent customer calls by searching for the words "arcing" and "smoke." His team found 18,500 records that matched. Six people then spent a weekend reading the results, eventually coming up with 700 calls from customers potentially related to the problem. As a comparison, Mr. Welke then ran the same records through a program from Attensity, which had recently paid him a sales call. "It could tell if the microwave was smoking or if the chicken was smoking hot or if the customer was eating smoked chicken," he said. "It came up with 542 instances in about 10 seconds." Whirlpool is now spending a quarter-million dollars a year on Attensity's expertise, joining companies like John Deere, General Motors and Honeywell as Attensity customers. But wringing profits out of unstructured data for corporate America is only about 40 percent of the software maker's business. The rest is in government work, for groups like the Federal Bureau of Investigation, the National Security Agency and the Defense Intelligence Agency. The software helps federal researchers look for clues to terrorist and criminal activities in "the text from the dispatches from around the world, the field reports, the newspaper articles and the chat rooms," said David L. Bean, Attensity's co-founder. "The intelligence community has plenty of systems for doing six degrees of separation, for putting two and two together," Dr. Bean said. "But they need structured data in order to do it. We give them that structure." The intelligence agencies declined to discuss whether they use the software. But Kris Alexander, a former intelligence analyst for the United States military's Central Command, noted that "putting unstructured information into anything that would organize it would be very helpful." "We have guys who can crack hard drives," Mr. Alexander said. "Getting the information out is easy. The hard part is sharing it, and organizing it, so that everybody in an agency, even nonexperts, can use it." Attensity's algorithms can do more than get a document ready to categorize, however. The software ferrets out meaning in sentences as they are being diagramed. If the word "purchase" is used as a verb, the person doing the buying is tagged as a possible customer. If the phrase "plastic explosive" is used as an object, the subject is labeled as a potential enemy. For now, though, Attensity works only with English. That is a weakness the company's competitors in the world of structuring data are quick to point out. Inxight Software, of Sunnyvale, Calif., for example, produces software that turns grammatical relationships into mathematical formulas, allowing it to parse documents in 31 languages. Intelliseek, of Cincinnati, plucks entities - proper names and places - from blog entries as a way to categorize them. The company's software will also characterize a document as positive or negative based on the words it contains. Oracle and the other major database makers also build in some limited functions for extracting information from unstructured texts. But those systems usually rely on the person using it teaching the algorithms what they need to know - that in a legal document, for example, "sued" and "filed charges" are rough equivalents. With Attensity's software, that kind of instruction is often unnecessary. "Attensity shows how the words all relate to one another - all the actors, objects and actions in a document, and how they connect," said Gayle von Eckartsberg, a spokeswoman for In-Q-Tel, which also provides financing for Inxight and Intelliseek. Perfect sentences are not required for the software to work, said Dr. Bean, the son of a high school English teacher. Instead of using strict grammar laws, Attensity relies on constantly reapplying heuristics - rules of thumb - to sort out subject from object. Dangling participles, misspelled words and grammar-mangling slang can all be handled, allowing Attensity to crunch Internet relay chats, instant messenger conversations and other King's English refugees as easily as it would parse a textbook. But that does not mean, Dr. Bean added, that students should stop doing their grammar homework or paying attention in school. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

bounty for errors in _Translucent Databases_
by R.A. Hettinga 03 Mar '05

03 Mar '05

--- begin forwarded text

1 0

Build your TV!
by R.A. Hettinga 03 Mar '05

03 Mar '05

<http://www.sfbg.com/39/22/cover_fcc.html> San Francisco Bay Guardian News THE SAN FRANCISCO BAY Mar. 2 - Mar. 8, 2005* Vol. 39, No. 22 Build your TV! As the FCC and the entertainment biz get ready to end home recording as we know it, a bunch of radical geeks are working on a solution or two. By Annalee Newitz 'ALL I WANT is to make a high-definition copy of Buffy the Vampire Slayer, save it on a DVD, and loan it to my friend," says Sarah Brydon, looking up from a long table covered with half-built computers. These sound like the words of a science fiction nerd, not a revolutionary. But Brydon is a new breed of protester - and she's expressing her discontent with the U.S. government by building a television. She's one of a dozen consumer activists who have gathered on a Saturday morning in late January for a high-definition television "Build-In" at the Mission District office of the Electronic Frontier Foundation (where I work). Part computer hardware nerdfest, part hell-raising political action, the Build-In is a high-tech protest of a new Federal Communications Commission regulation called the "Broadcast Flag." According to the FCC, the flag is going to ease the nation's transition from today's analog televisions to tomorrow's high-definition televisions. What exactly does it mean for a government agency to "ease" the transition from one kind of TV signal to another? In this case, it seems to mean making the entertainment industry feel very warm and fuzzy inside. The Broadcast Flag is designed - poorly - to stop people from putting high-quality recordings of TV shows on popular file-sharing networks like BitTorrent. In reality, it will give the government an unprecedented amount of control over what we do in our own homes with recordings of HDTV. The flag is supposed to stop mass copying and infringement, but it will also stop most consumers from perfectly legal activities like saving HD copies of shows for personal use. Past generations of media activists protested government and industry control of TV content. They battled FCC censorship, denounced market grabs by massive content conglomerates like News Corp., whose bland, mainstream programming turned a diverse media landscape into The O'Reilly Factor and 7th Heaven reruns. Those activists nourished independent TV content on local cable access channels, where they could talk openly about radical politics or get naked on a whim. Now the Broadcast Flag has alerted a new group of media guerrillas to another way in which government and industry control pop culture: by locking down the devices that receive, copy, and remix broadcast signals. And these activists are responding by building independent technologies that don't bend to the will of the FCC or MGM. The televisions created at the Build-In are also computers, and they contain a TiVo-like device called a personal video recorder (PVR) - you can use them to pause a show, record it, sample it, and even save a copy to DVD. Using the TV she builds today, Brydon won't have any trouble loaning her friend a copy of Buffy. The television liberation front By noon every surface in the EFF office is covered with computer guts: multicolored ethernet cables lie in snarled piles all over the floor, hard drives occupy precarious positions near half-eaten bagels, TV antennae poke into the air, and exposed circuit boards are tenuously connected to monitors whose output isn't always good. These TVs are going to rock, but getting the software running perfectly is a pain in the ass. Celebrated consumer gadget blogger Phillip Torrone is bouncing around the room, interviewing everybody with his iPod for a Podcast about building televisions. He's flown down from Seattle just for the Build-In. "Tell me about this machine!" he says excitedly, thrusting the little white device at audiovisual geek Gregor Menasian, who has packed the last bit of open space with a computer full of extremely sweet components: quiet fan, capacious hard drive, fast CPU. As the two of them talk, EFF special projects coordinator and attorney Wendy Seltzer snaps photos of an error message on Menasian's monitor. Seltzer, who helped organize the Build-In, wants to be sure that accurate reports of glitches go to the hackers who wrote the software everybody's using today to turn their computers into HDTVs with built-in PVRs. Called MythTV, it's named for the "mythical convergence box" gadget-crazy futurists often predict will finally combine TVs, DVD players, Web browsing, and stereos in one simple machine. What has galvanized this group - made up of TV fans, civil liberties activists, and politically minded hackers - is outrage at what the Broadcast Flag will do to the future of innovative, crazy-dream devices like MythTV. After the mandate goes into effect July 1, it will be illegal for anyone in the United States to manufacture a device that records high-definition television unless it's built to obey a special signal - the flag - emitted by stations broadcasting HD shows. The flag will tell PVRs and other equipment whether they're allowed to copy a show onto some other medium, like a DVD. In short, broadcasters and content owners will actually be able to control your recording habits. Let's say, for example, that it's a couple of years from now, and your TiVo (bought anytime after July 1 of this year) has recorded the excellent Marx brothers movie Animal Crackers, which was just broadcast on TNT in HD. Tomorrow you're getting on a plane to Australia, and you'd like to save a copy on DVD to watch on your computer during the 15-hour flight. You're entitled to make a personal copy under federal copyright law, so it should be no problem. And in fact, it was no problem back in the days of analog broadcasts and VCRs. But with the Broadcast Flag in place, TNT can send out a signal that tells your TiVo not to make HD copies of Animal Crackers. So when you burn that DVD and put it into your computer somewhere over the Pacific, you get a bunch of garbage. The FCC has just stolen your rights. Think of it this way: if the Broadcast Flag applied to VCRs, it would, in effect, allow you to tape shows but not necessarily take the tape out of the VCR. And you'd likely be forced to erase your show in order to tape the next thing. Certainly there may be broadcasting companies that refuse to send out the flag, or that send out a flag saying "go right ahead and copy this." But a company like Paramount, which owns the rights to Star Trek, is unlikely to allow them to do so, for fear that letting people make copies will undercut its ability to sell syndication rights to Spike TV and UPN. Networks like CBS aren't going to want to let their shows out of the box either - they don't want to lose control of their intellectual property. For years we've taken for granted our ability to record television programs to enjoy weeks or even years later. Now that we have a chance to get extremely high-quality, HD broadcasts, the FCC is trying to take our HD media libraries away from us. Why would it do this, especially given that it has received absolutely no mandate from Congress? Basically, the agency succumbed to pressure from Hollywood. Entertainment companies figure that as long as the copies available online are of a lower quality than what's on TV, the broadcasters have a leg up on downloaders. But instead of relying on the law to stop people from infringing copyrights, these companies lobbied the FCC to take control of the marketplace and force vendors to sell machines that make all forms of copying effectively impossible. If your super-excellent HD copy of CSI can't get out of the TiVo box, then you can't stick it online and break the law. Too bad you can't do what the law permits either. Even more disturbing, the Broadcast Flag mandates that recording devices be "robust against user modification." In plain language, that means consumers can't repair, tinker with, or optimize their own machines. What's more, it will also become impossible for small, upstart technology companies to break into the consumer electronics market for TV recorders. If they can't take apart the devices that output the HD signal, they can't build cool new devices to play with that signal. Which also means that the devices people are using at today's Build-In will be illegal in four months. The government-entertainment industrial complex "I don't care about TV, and I don't watch it," says Build-In organizer Seltzer, who's been fine-tuning her MythTV box for several months, coaxing better and better performance out of it. "I'm concerned with the Broadcast Flag because it could be the first step in a new kind of technology regulation" - a precedent-setting moment in which one government agency takes control of the high-tech marketplace, allowing only certain companies to manufacture devices outputting the HD signal. It seems a dangerous direction to be heading in. For now, consumers may not realize the immense impact of the Broadcast Flag - the big content owners and the FCC are being pretty foxy about it. Even after the Broadcast Flag goes into effect, you'll still be able to make low-quality copies with your VCR. Most televisions are still receiving and outputting analog signals. The full impact of the flag won't be felt for several years, when most broadcasts are in HD and most people have chucked their VCRs. Suddenly you'll find out that the DVD player you bought last year can't play HD programs you burned from your new TiVo. Sound confusing or hard to imagine? That's precisely the point - the FCC is counting on your not being able to figure it out until it's much too late. Over the next decade, HD is going to become the standard signal - most new TVs will be able to tune it, and free-to-air networks like ABC, CBS, and Fox are going to move to HD broadcasting. So will cable. Most networks already make some shows available in HD - CSI, most sports events, some PBS shows, like The Desert Speaks. If your current TV receives HD, you'll know it - the quality is so much better it's almost scary. A traditional analog TV creates its picture out of 480 interlaced lines on your screen, while a typical HDTV creates the same picture using 1,080 interlaced lines. Those extra lines mean more detail, more intense color, and an eerie sense that the picture on your screen is literally the same quality you'd get if you were watching something with your own eyes. The FCC is acting now to shut down what you can do with this amazing quality because once consumers have something (the way they've long had VCRs that record TV), it's harder to take it away. As long as what's being taken away is something "in the future," it's hard to feel like you're losing. But of course you are. For a perfect example of how you'll feel this loss, consider the DVD player. Ever wonder why there have been no new nifty gadgets you can use with your DVD player for at least 10 years? Seems strange, doesn't it? I mean, think of how many new hoozits and zoomies have been invented for your computer in the past decade. Given the rate of invention in this country, shouldn't DVDs be making breakfast for you by now? There's one simple reason they aren't. A coalition of companies from the entertainment, consumer electronics, and computer industries got together in 1999 and formed a group called the DVD Copy Control Association, which enforces a strict standard on all devices that can play DVDs. Anyone who develops such a product must comply with the CCA's standards, which include forcing it to place copy protections on any copies made of a DVD. Those protections mean you can only play the DVD in "approved" devices, such as a Sony DVD player or a Microsoft Media Player. It means you can't run the DVD through a mixing board to make a video collage, or create a tiny digital copy of it to play in your cell phone when you're bored on the bus. Just a few weeks ago, a company called Kaleidescape was sued by the CCA for having the audacity to invent something it called a DVD jukebox - a cool device that could hold dozens of movies ripped from DVDs and output them to as many TVs or computers as the user liked. It was sort of like an iPod for movies, except several people could watch the movies in the same house at the same time if they wanted. At $27,000, the DVD jukebox is a very high-end toy. Kaleidescape execs say it's ideal for somebody who wants to make his or her DVD collection available to people in multiple rooms all over a large house (like, say, Steve Jobs's). CCA sued Kaleidescape on the grounds that the jukebox promoted piracy, despite the fact that the recordings in it were made from legitimately purchased DVDs and that copies couldn't be removed for distribution elsewhere. The industry group wanted Kaleidescape to rebuild it so that viewers had to insert the DVD they were watching to prove they actually owned it. Of course, that would defeat the whole purpose of a jukebox. It would be nothing more than a very expensive DVD player. And that pretty much sums up why the DVD player you bought in 1995 isn't much different from the one you'll buy tomorrow. This is a situation that sucks for the consumer and sucks for the small-business owner or innovator who wants to bring his or her ideas to market. The Broadcast Flag will create a cartel similar to the CCA, only this time the government will be directly involved. Instead of the CCA launching a civil suit against somebody for making a noncompliant device, under the Broadcast Flag the government will be able to fine that person or stop him or her from selling the product. This will allow big media companies like MGM, Sony, and Paramount to get what they want - total control of how you watch television - without having to get their hands dirty. Already, small-business owners like Jack Kelliher - who runs a tiny computer hobbyist company called pcHDTV - are being forced to change their business strategies to survive the flag. A longtime hardware hacker and entrepreneur, Kelliher sells a computer component called a PC card that lets computers tune in HD signals like a television (people at the Build-In used his cards to turn their computers into TVs). "We wanted to do something for hobbyists who wanted to build their own HD systems," he tells me by phone from his office in Utah. "But then the FCC did their embargo, and the rule means we can't offer the product next year." He and his partners are scrambling to come up with other (legal) products to sell next year, in order to make ends meet. Among other things, they're creating a computer card that will receive TV signals and output them to analog devices that aren't affected by the Broadcast Flag. "This whole thing bothers me because I come from an era when we built radios in high school and stuff like that," Kelliher says. "Being able to build your own TV seems really American to me. It's sad that the government wants to halt innovation - it's just un-American." Another innovator whose brainchild will be seriously affected by the flag is Isaac Richards, the Ohio-based lead developer of MythTV, the program the Build-In participants are using to make their computers act like PVRs. MythTV interacts with a PC card like Kelliher's, then displays TV shows on your monitor. It also records and stores shows, movies, and music, and it can even be set up to display the weather for your area (scraped from the Weather Channel) and bring you the latest news from your favorite blogs. It's not much different from TiVo - except that it's free and it isn't authorized by the FCC. Like many inventors, Richards started his project because he wasn't satisfied with what was commercially available. "I wanted a TiVo, but it was limited," he says. "And the concept was simple: you just record TV and play it back." Since Richards released the first version of MythTV on the Net two years ago, the program has become quite popular: nearly 100,000 people downloaded the last release. And part of what makes MythTV such a seductive package is the fact that it's entirely open: anyone can add to it. It's the diametrical opposite of a DVD player, whose every element must be reviewed and approved by an industry cartel. In general, people are using MythTV to watch analog TV. But when HD becomes the standard, MythTV's development may face stagnation. As analog becomes an obsolete format, MythTV will also become obsolete. People can build their own analog TVs, but they won't be able to build their own HDTVs. And thus there's no chance an upstart young innovator like Richards will ever create a bigger, badder, cooler PVR for HDTV the way he did with MythTV for analog. Looked at from this perspective, the Broadcast Flag isn't really a deterrent against piracy so much as a deterrent against the big consumer electronics companies losing market share to little guys with big ideas. As long as it's illegal for people like Richards to tinker around with HD components, nobody will ever invent something better than TiVo or Media Player. It simply won't be possible to create new HD-related toys without a fleet of expensive lawyers in tow. The Broadcast Flag is an unholy alliance of government, big entertainment, and big electronics. Each is protecting the others' interests so that they can maintain control over the marketplace. The only losers in the deal are small entrepreneurs and consumers. Geeks and librarians unite Hope is not lost - at least, not yet. Several public interest groups, including Washington, D.C.-based Public Knowledge and the EFF, as well as the American Library Association, are fighting the Broadcast Flag tooth and nail. Librarians worry that limiting devices that can output HD may interfere with future methods for distance learning and archiving. Public Knowledge is concerned with the bigger picture. As executive director Gigi Sohn puts it, "People who want to make fair use of copyrighted materials won't be able to do it." In other words, no personal copy of Animal Crackers to make the flight to Australia less arduous. Last week, a D.C. appeals court heard oral arguments in ALA v. FCC, the lawsuit these groups brought against the FCC, in which they argue that the FCC overstepped its jurisdiction when it mandated the flag. "There is no precedent for what the FCC did here," Sohn says. "Every time the FCC has regulated devices, it's because Congress gave it the authority. But this rule isn't based on any congressional mandate or even ancillary to a provision in the Communications Act." Sohn, who was at the oral arguments, says the three-judge panel was very persuaded by the merits of the case. All three acknowledged that the flag seemed unnecessary to ease the nation's transition to HDTV - one even remarked that this was as ridiculous as the FCC attempting to regulate washing machines. Unfortunately, the case may hit a snag when it comes to whether these groups actually have standing to bring the case. The court seemed eager to have more concrete examples of how people would be harmed by the mandate. "Of course, it's hard to come up with concrete examples when the devices in question aren't even out yet," Sohn points out. And may never be, given the flag rule's chilling effects. The EFF's Seltzer says the flag will create media fiefdoms, in which consumers are locked into particular devices or sets of devices in order to enjoy their media. It will be costly to buy a set of flag-compliant consumer electronics that all work together - and even when you do, recordings made in, say, a Sony machine won't be able to play in a Microsoft one. Which is just one more reason why it's time to build your own TV. Back at the Build-In, Seltzer and Brydon are jumping up and down and shouting. "We've got TV!" Seltzer exults. Brydon can't stop grinning at her monitor, where they've tuned in some local news. The picture is still a little jerky - the software needs some tuning - but we've got our first HDTV working. Best of all, it's a liberated TV - it isn't an "authorized device," and it's not "broadcast flag compliant." It certainly isn't "robust against user modification." But because it was built before the July 1 start date of the Broadcast Flag rule, it's going to remain perfectly legal. This TV will always be able to record HD shows and burn them to DVDs for personal use. Next year, Brydon can loan her friends an HD-quality copy of Battlestar Galactica if they missed it that week. Dale Kiefling, another Build-In participant, is almost ready to channel surf on his box too. He and his friend Lorena Fleming say they're excited to play around with TV the way they do with their computers. "I think the Broadcast Flag punishes the wrong group," Kiefling says. "The people who do mass piracy will always have the means to - the flag won't stop them. Meanwhile, the rest of us are stuck with broken entertainment systems." All the people who now take for granted the act of removing a tape from their VCR - the Star Trek fans, the OC addicts, the Marx brothers aficionados - will gradually discover they can't do the same thing with their new PVRs. Copyright law permits consumers to make personal, fair-use copies of their media. And yet the government-entertainment industrial complex will have engineered every device to stop them. "That's the worst part of all this," Fleming says. "People won't realize how bad it is until suddenly their stuff stops working." Annalee Newitz is policy analyst at the Electronic Frontier Foundation and a freelance writer. Get the gory details at www.techsploitation.com. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

How to Stop Junk E-Mail: Charge for the Stamp
by R.A. Hettinga 03 Mar '05

03 Mar '05

Actually, it's not just "sender pays", it's "a whitlist for my friends, all other others pay cash", but "sender pays" will do for a start. :-) Cheers, RAH ------- <http://www.nytimes.com/2005/02/13/business/yourmoney/13digi.html?th=&pagewa…> The New York Times February 13, 2005 DIGITAL DOMAIN How to Stop Junk E-Mail: Charge for the Stamp By RANDALL STROSS OMPARE our e-mail system today with the British General Post Office in 1839, and ours wins. Compare it with the British postal system in 1840, however, and ours loses. In that year, the British introduced the Penny Black, the first postage stamp. It simplified postage - yes, to a penny - and shifted the cost from the recipient to the sender, who had to prepay. We look back with wonder that it could have ever been otherwise. Recipient pays? Why should the person who had not initiated the transaction be forced to pay for a message with unseen contents? What a perverse system. Today, however, we meekly assume that the recipient of e-mail must bear the costs. It is nominally free, of course, but it arrives in polluted form. Cleaning out the stuff once it reaches our in-box, or our Internet service provider's, is irritating beyond words, costly even without per-message postage. This muck - Hotmail alone catches about 3.2 billion unsolicited messages a day - is a bane of modern life. Even the best filters address the problem too late, after this sludge has been discharged without cost to the polluter. In my case, desperation has driven me to send all my messages sequentially through three separate filter systems. Then I must remember to check the three junk folders to see what failed to get through that should have. Recipient pays. Do not despair. We can now glimpse what had once seemed unattainable: stopping the flow at its very source. The most promising news is that companies like Yahoo, EarthLink, America Online, Comcast and Verizon have overcome the fear that they would prompt antitrust sanctions if they joined forces to reclaim the control they have lost to spammers. They belong to an organization called the Messaging Anti-Abuse Working Group, formed only last year. It shares antispam techniques and lobbies other e-mail providers to adopt policies that protect the commons. Civic responsibility entails not merely screening incoming mail to protect one's own customers but also screening outgoing mail that could become someone else's problem. Carl Hutzler, AOL's director of antispam operations, has been an especially energetic campaigner, urging all network operators to "cut off the spammer's oxygen supply," as he told an industry gathering last fall. And those operators who do not "get smart soon and control the sources of spam on their networks," he said, will find that they "will not have connectivity" to his provider and others who are filtering outgoing e-mail. He did not spell out the implications for customers, but he doesn't need to: we can select a service provider from the group with a spam-free zone, or one that has failed to do the necessary self-policing required for joining the gated community and is banished to the wilds of anything-goes. One measure backed by advocates like Mr. Hutzler is already having a positive impact: "Port 25 blocking," which prevents an individual PC from running its own mail server and blasting out e-mail on its own. With the block in place, all outgoing e-mail must go through the service provider's mail server, where high-volume batches of identical mail can be detected easily and cut off. Internet service providers are also starting to stamp outgoing messages with a digital signature of the customer's domain name, using strong cryptography so the signature cannot be altered or counterfeited. This is accomplished with software called DomainKeys, originally developed by Yahoo. It is now offered in open-source form and was recently adopted by EarthLink and some other major services. A digital signature is what we will want to see on all incoming e-mail. If your Internet service provider is not on the working group's roster, you can insist that it take the oath of good citizenship. This month, MCI found itself criticized because a Web site that sells Send-Safe software gets Internet services from a company that's an MCI division customer. Send-Safe is spamware that offers bulk e-mail capability, claiming "real anonymity"; it hijacks other machines that have been infected with a complementary virus. Anyone can try it out for $50 and spray 400,000 messages. MCI, for its part, argues that it has an exemplary record in shutting down spammers, but that the sale of bulk e-mail software is not, ipso facto, illegal. Unfortunately, there has been no good news on the legal front. When the first batch of antispam bills was introduced in Congress in 1999, one could have reasonably expected that legislators were ready to stamp out unsolicited e-mail, just as they had banned unsolicited faxes with the Telephone Consumer Protection Act of 1991. While spam-filled e-mail boxes do not entail monetary costs in the form of fax paper and toner, they cost us dearly in time. Surely Congress would not be so literal-minded when comparing e-mail with faxes as to miss the parallel and equally offensive notion of "recipient pays"? The years passed, the antispam bills multiplied, hearings were held and more bills were introduced, with each session's bills weaker than the previous ones. In the end, in 2003, we got the Controlling the Assault of Non-Solicited Pornography and Marketing Act, or Can-Spam. Its backers took a brave stand against deceptive subject lines and false headers and then went home. The law did not prohibit unsolicited commercial e-mail and has turned out to be worse than useless. "Before Can-Spam, the legal status of spam was ambiguous," said Professor David E. Sorkin, an associate professor at the Center for Information Technology and Privacy Law at the John Marshall Law School in Chicago. "Now, it's clear: it's regarded as legal." Only fraudulent representations in unsolicited bulk e-mail are verboten, but "unsolicited" has now been blessed, and so, too, has "bulk." Katie, bar the door! Instead of giving marketers access to our e-mail boxes only if we expressly indicate that their attention would be welcome, which is an "opt in" system, Can-Spam gives the direct marketers the gift of an "opt out" system, where the onus is on us to notify each sender, one by one, that we do not wish to be on its list. Recipient pays, again and again. If one goes back and reads the transcripts of the hearings held in the summer of 2003, before the bill's passage, one is treated to an edifying "how a bill becomes law" lesson. An especially enlightening moment was when Representative Richard Burr, a North Carolina Republican since elected to the Senate, spoke passionately about unsolicited commercial e-mail: "I think there is one thing that we can all agree on. One, we would all like to get the discount airfare offers, we would like to get the discount hotel offers. We never know when they are going to be advantageous to us." Looking to the future, let's not count on Congress to do any better in spurning the blandishments of the Direct Marketing Association. And let's not count on authentication technologies like DomainKeys as a panacea. Even when most mail is properly authenticated, we will still have to figure out whether to trust names that are unfamiliar to us. What we need is a way to make all bulk e-mailers pay for the privilege of using our e-mail boxes. That would make legitimate businesses focus on the best prospects, just as bulk mailers of ordinary junk must do. And it would force spammers to shell out for an expense unfamiliar to them: buying "stamps." That would bring a swift, permanent end to their activities. What we need, in other words, is what was proposed in 1992 at the International Cryptology Conference. In a paper titled "Pricing Via Processing, or Combating Junk Mail," two computer scientists, Cynthia Dwork and Moni Naor, came up with a way to force a sender to pay every time a message was sent - payment not in money, but in time, by applying the computer's resources to a computational puzzle, devised on the fly for that particular message. Ms. Dwork now works at Microsoft Research in Silicon Valley and has continued to work on the project. It has yet to be adopted in a commercial e-mail service, but it shows promise in its current form. The puzzle uses an intricate design involving the way a computer gains access to memory and resists a quick solution by speedy processors, requiring about 10 seconds. It is not so long that you'd notice it for the occasional outgoing message, but if you have eight million Viagra messages queued up, good luck in getting each one "stamped." Use of the system would always be voluntary, and wholly unnecessary when sending to friends and family. On the receiving end, your e-mail program could be set to filter incoming messages arriving from unfamiliar senders on the basis of proof of completion of the assigned problem. No stamp, no entry. Ms. Dwork and her colleagues have named this the Penny Black Project. Sender pays. Randall Stross is a historian and author based in Silicon Valley. E-mail:ddomain@nytimes.com. Copyrigh -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

9 12

RE: SHA-1 results available
by Whyte, William 03 Mar '05

03 Mar '05

> http://theory.csail.mit.edu/~yiqun/shanote.pdf > > No real details, just collisions for 80 round SHA-0 (which I > just confirmed) > and 58 round SHA-1 (which I haven't bothered with), plus the > now famous work > factor estimate of 2^69 for full SHA-1. > > As usual, "Technical details will be provided in a > forthcoming paper." I'm not > holding my breath. A preprint was circulating at the RSA conference; Adi Shamir had a copy. Similar techniques were used by Vincent Rijmen and Elizabeth Oswald, in their paper available at .http://eprint.iacr.org/2005/010. William --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

FYI: paper about Metcalfe's Law
by R.A. Hettinga 03 Mar '05

03 Mar '05

--- begin forwarded text

1 0

FYI: paper about Metcalfe's Law
by Andrew Odlyzko 03 Mar '05

03 Mar '05

Dear Colleagues, Sorry for the spam, but I thought you might be interested in the paper described below. Comments are invited. Andrew A refutation of Metcalfe's Law and a better estimate for the value of networks and network interconnections Andrew Odlyzko Digital Technology Center University of Minnesota odlyzko(a)umn.edu Benjamin Tilly ben_tilly(a)operamail.com Abstract Metcalfe's Law states that the value of a communications network is proportional to the square of the size of the network. It is widely accepted and frequently cited. However, there are several arguments that this rule is a significant overestimate. (Therefore Reed's Law is even more of an overestimate, since it says that the value of a network grows exponentially, in the mathematical sense, in network size.) This note presents several quantitative arguments that suggest the value of a general communication network of size n grows like n*log(n). This growth rate is faster than the linear growth, of order n, that, according to Sarnoff's Law, governs the value of a broadcast network. On the other hand, it is much slower than the quadratic growth of Metcalfe's Law, and helps explain the failure of the dot-com and telecom booms, as well as why network interconnection (such as peering on the Internet) remains a controversial issue. FULL PAPER AT: http://www.dtc.umn.edu/~odlyzko/doc/metcalfe.pdf --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

FYI: paper about Metcalfe's Law
by Andrew Odlyzko 03 Mar '05

03 Mar '05

Dear Colleagues, Sorry for the spam, but I thought you might be interested in the paper described below. Comments are invited. Andrew A refutation of Metcalfe's Law and a better estimate for the value of networks and network interconnections Andrew Odlyzko Digital Technology Center University of Minnesota odlyzko(a)umn.edu Benjamin Tilly ben_tilly(a)operamail.com Abstract Metcalfe's Law states that the value of a communications network is proportional to the square of the size of the network. It is widely accepted and frequently cited. However, there are several arguments that this rule is a significant overestimate. (Therefore Reed's Law is even more of an overestimate, since it says that the value of a network grows exponentially, in the mathematical sense, in network size.) This note presents several quantitative arguments that suggest the value of a general communication network of size n grows like n*log(n). This growth rate is faster than the linear growth, of order n, that, according to Sarnoff's Law, governs the value of a broadcast network. On the other hand, it is much slower than the quadratic growth of Metcalfe's Law, and helps explain the failure of the dot-com and telecom booms, as well as why network interconnection (such as peering on the Internet) remains a controversial issue. FULL PAPER AT: http://www.dtc.umn.edu/~odlyzko/doc/metcalfe.pdf --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0