- cypherpunks-legacy - lists.cpunks.org

RE: RE: Binding cryptography - a fraud-detectible alternative to
by Hal Finney 17 Dec '03

17 Dec '03

From: everheul(a)mail.rijnhaave.nl > Hal Finney[SMTP:hal@rain.org] wrote: > >Another flaw with schemes of this time (in terms of failing to meet > >their goals) is that they cannot detect superencryption and other > >forms of non-standard encryption of the message body proper. All > >they can really do is verify from the outside that the same session > >key is encrypted for the two recipients (the intended recipient and > >the Government Access to Keys Party - let's not abuse the term by > >calling him a Trusted Third Party). But they can't be sure that the > >session key is sufficient information to decrypt the message. > We offered a solution for the *first* task not for the *second*; the > point is that criminals(!) do not gain any real advantage from using > the system in that way as they - among other things - still face the > key-management problem. The above dicussions are only relevant in > countries where the use of crypto outside the structure would be > prohibited. BTW, it is by such discussions that I believe such a ban > is ineffective and in fact counterproductive. I have not read your paper, but let me illustrate via what may be a similar scheme how criminals can use the key management infrastructure, create messages which look good from outside, yet which still cannot be read by the GAK (government access to keys) people. In ElGamal encryption we start with a message session key M which we want to send across. We have the public key y1 = g^x1 of the recipient (^ is exponentiation). We choose a random blinding factor xm, and calculate ym = g^xm. We send ym and M * (y1^xm). y1^xm equals g^(x1*xm), and the recipient can recover this by ym^x1. Now with two recipients, if we choose the same blinding factor xm for both, we send ym = g^xm, and both M * (y1^xm) and M * (y2^xm). We use the two different recipients' public keys y1 and y2. I believe this can be checked from outside by taking the ratios of these two factors (y1/y2)^xm and using known methods to prove that this is of the proper form. This can be circumvented though simply by replacing M, the true session key, with M' = M*(y1^xm), where y1 is the intended recipient (and y2 is the GAK party). We send M'*(y1^xm) and M'*(y2^xm). Outsiders still verify that this is of the proper form. And the intended recipient can calculate the true M by dividing twice by y1^xm instead of once (in effect M' is the El Gamal encryption of M for party 1). But the GAK party, who gets M'*(y2^xm) and recovers M', finds it useless in trying to decrypt the message. This shows how keys from a standard infrastructure can be used in a slightly non-standard way to confound your scheme. Granted, the parties involved have to share knowledge about using the keys in this non- standard way, but that is only one bit of information and not at all hard to distribute. Hal

1 0

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by jim bell 17 Dec '03

17 Dec '03

At 04:01 AM 10/14/96 -0400, Black Unicorn wrote: >On Sun, 13 Oct 1996, jim bell wrote: > >> At 04:28 PM 10/13/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >> >It is unpublished, but he kindly allowed to me describe it in a paper I >> >wrote that discussed whether a bank would ever want to take the risk of >> >allowing bank accounts where it did not know the identity of the customer. > >> And I don't think that a bank can ever be embarrassed (assuming bank >> accounts are anonymous) by it being revealed that some particular bad guy >> kept his money there, any more than other cash-based (anonymous) businesses >> are embarrassed if it is revealed that some bad guy used their services. > >I would refer you to Union Bank of Switzerland in the late 80's >(kidnapping), BCCI (drug and intelligence money), BMI (drug >money/offshore insurance fraud), PNC Bank (accounting fraud), and a host >of others I won't bother to list. Banks do suffer from these disclosures, >in many cases quite severely. (PNC bank was nearly ruined by their fraud >harboring disclosures). Are you talking about ANONYMOUS accounts, or merely CONFIDENTIAL ones? (Anonymous accounts, as I use the term, are ones in which even the bank doesn't know the owner.) I think you're lumping these two things together; I was not. Jim Bell jimbell(a)pacifier.com

2 1

Recovery after flood
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I'd appreciate a response from M.Aldrich and anyone else who's into disaster recovery: Someone I know had their (paper) files submerged in water. Now all the papers (most of them xerocopies, some photographs) are stuck together. They are, of course, confidential to some degree. Can someone refer us to someone in the Boston area who could assist in recovering the files? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 4

Spook O.T.M.?
by Douglas B. Renner 17 Dec '03

17 Dec '03

1 0

Re: crypto wish list (was Re: A "RIGHT" to strong crypto?)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>> Where is a fully functional and secure "stealth PGP"? > >PGP stealth 2.01 beta is at: http://www.dcs.ex.ac.uk/~aba/stealth/ > >It is not release quality. > >I've been meaning to fix that for a while now, a release version will >be out RSN. > >Do you, or anyone else who is interested see any advantage in having >stealth functionality integrated into PGP, say as a patch for PGP263i >/ mit PGP262? Not that hard to do, if there's any interest for it to >be integrated. > >Zbigniew Fiedorowicz <fiedorow(a)math.mps.ohio-state.edu> added stealth >and SHA1 support directly to a MAC version of PGP. The key words `fat >mac pgp' in a www search engine would probably find it. Or `Zbigniew >pgp'? Best to use <http://128.146.111.31/~fiedorow/PGP/#sha1> > >> Where are anonymous and encrypted WWW clients and hosts which permit >> chaining? > >Folks working on this? The only person I know of to announce such a project was Ray Cromwell. His Decense project was discussed on this list briefly in February. I believe the source is still posted at <http://www.clark.net/pub/rjc/decense.html>. I've tried to contact Ray to get an up date on progress, but without results. The shortcoming of Ray's approach is that it requires intermediate servers to re-route all client-server packets and therefore someone must provide that, considerable, bandwidth for free or fee. If someone were to set up a real-time BlackNet it could provide a superset of Decense and also offer considerably improved anonymity. I've heard some months ago that such a project is under consideration. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

2 1

RE: binding cryptography
by Eric Verheul 17 Dec '03

17 Dec '03

Ulf Moeller[SMTP:um@c2.net] wrote: >: liberal (Japan) to non-liberal (France). We believe that "binding >: cryptography" is flexible enough to achieve this: a liberal crypto >: policy might use no Trusted Retrieval Parties at all, while a very >: non-liberal country might want one (government controlled) TRP, a >: compliance check on all network traffic and a ban on other crypto. > >I doubt that even French internet providers would want their routers >to perform six modolo exponetiations and four modolo divisions >whenever someone opens a secure socket... They could, however, take random checks which could also be performed off-line (after the connection was established or even already finished again). Remember we called it fraud-*detecting* not fraud-*preventing*. BTW, some people on the cypherpunks list seem to think that you can't fraude with a *voluntary* system. However, that is possible: when you do not comply with the *agreed* rules of conduct then the phrase "fraude" is appropriate. The same holds, for instance, when you make copies of microsoft word and resell them. Then you don't comply to the rules that you voluntarily agreed to when buying it... > We offered a solution for the *first* task not for the *second*; the > point is that criminals(!) do not gain any real advantage from using > the system in that way as they - among other things - still face the > key-management problem. The above dicussions are only relevant in > countries where the use of crypto outside the structure would be > prohibited. > >Of course, criminals do get real advantage from this system. They can >use strong encryption for their messages and super-encrypt them using >"binding" cryptography. So their illegal messages look perfectly >inconnous as long as their government trusts in the "binding" property >of this scheme. Only when the GAK key holder tries to decrypt a >message, they notice that they cannot read it. I agree, that is inevitable. > >Can you imagine that anyone would ever create a program that tries to >look like a conforming implementation, but generates invalid "binding" >data -- when it is so much easier to simply use PGP, and (if >necessary) disguise that fact using the government-approved encryption >software? I don't, so in my opinion the verification process is >abolutely useless. Can you imagine what would happen if governments would (help to) set up a system that has no safeguards at all, i.e. that could give criminals all the anonimity and confidentiality they need? Governments can't probably prevent criminals and the like to use encryption to stay out of sight of law enforcement agencies, but they should not facilitate them either. In the next few years all kinds of "standard" commerical software will come on the market with all kinds of standard security in it. I don't want criminals to be happy with Custom of The Shelf products for security, let them work for their security. One might say, binding cryptography, like several >other cryptographic protocols, is a nice 'solution', but one with no >corresponding 'problem' in the real world. :) It doesn't help in >legitimate law enforcement, but it causes trouble to network operators >and it deprives law-abiding citizens of their privacy. We have set up the TRPs in such a flexible way that anybody could find one he can trust, one might even set up his own TRP. Also in the paper we describe how two or more TRPs could be used. Maybe some countries don't want TRP at all. The bottom line is that law-abiding citizens always have to give up some of their freedom to stop criminals (that is why you have to have registration plates on your car, a lock on your car, bicycle, house etc.). That is a fact of life; one I hate. So the point is: where is the middle of giving up freedom and stopping criminals? Well, I think that our concept gives a flexible way of implementing any national middle.. I agree with some of the poster to cypherpunks that governments involves the general public too less in the determination of this middle (some posters said it more strongly). Cryptopolicy is not a binary discussion; although some posters on this list seem to think so. >And criminals don't face "the key-management problem". In any GAK >scheme, the official keys can be used to certify other un-escrowed >encryption keys. Binding cryptography makes it just a little easier, >because there is no need to create any "illegal" key pairs. Everyone >can encrypt messages using the government-certified ElGamal keys, >and then repeat that process, this time including the data required >for goverment access. > that use of other systems will always be possible. Also, the above > discussions already showed that if such a system is voluntary, then > there are lots of way to go around it. > >Criminals will always find ways around these systems -- even if they are >mandatory. Just those who actually "have nothing to fear", will not >go in the risk to use illegal encryption. So governments can wiretap >law-abiding citizens, but not criminals. What useful is a system like >that? > You are absolutely right. However, as said above if governments (help to) set up a security system then they should at least attempt to make criminal abuse difficult. The lock on my bicycle is not really 100% either (as I found out quite to often); if I'd no lock at all I would have a lot more problems. Also, I am *not* for a mandatory system. Best regards, Eric

3 2

News_dal_Ragno_Italiano.
by Samuele Landi 17 Dec '03

17 Dec '03

Questo e' un messaggio informativo automatico per un servizio gratuito di pubblico interesse. Viene spedito una sola volta per lo stesso indirizzo e-mail anche se sono presenti piu' pagine. Il "Ragno Italiano" e' lieto di comunicarle che le pagine da lei pubblicate sul WWW sono state catalogate nel nostro motore di ricerca. Saranno visibili a indicizzazione completata di di tutti i siti italiani prevista per il 30/10/96. Il "Ragno Italiano" e' il motore di ricerca per l'italia con oltre 500.000 pagine catalogate e ricercabili subito all'indirizzo: http://ragno.ats.it -------------------------------------------------------- Sponsor permanente: http://www.webspace.it ====================== 50 mb di spazio WWW con dominio proprietario (www.nome_azienda.it/.com) per 150.000 Lire al mese -------------------------------------------------------- Il "Ragno Italiano" e' motore di ricerca anche per: - Indirizzi e-mail in Italia - Newsgroups Italiani - Meta-Interfaccia per tutti i maggiori motori di ricerca mondiali Cordiali Saluti. Samuele Landi - WebMaster ragno.ats.it

1 0

Re: SPA sues C2, other ISPs and users
by Douglas Barnes 17 Dec '03

17 Dec '03

I just wanted to weigh in on a couple of points that have been raised with respect to the SPA lawsuit against C2Net: 1) I don't think this is some sort of evil plot by SPA members because we hadn't joined or because we're competing with some of their members. A lot of their members compete with other members and non-members and nothing like this has happened before. It's pretty clear that they were oblivous to a great many things, including the fact that we're primarily a software company these days. 2) As obnoxious as the lawsuit is, we don't miss the humor in the fact that we've been grumbling (on-line and off) about folks who pirate Stronghold (our commercial, secure version of the Apache web server). We really were looking into joining the SPA, to see if it would do us any good in dealing with this problem. 3) If you run across any mention of this lawsuit in the media, either on-line or in print, it would be great if you could forward it to me at cman(a)c2.net, or fax it to me at: 510 986 8777. I want to be tracking the press coverage very closely, and our clipping services takes about 5-10 days to read and process clippings for us. Thanks for your help, Douglas Barnes VP Sales & Marketing C2Net

2 1

WOW!
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I just totaled up the "Bring Dimitri to San Francisco" pledges. The pledges add up to an amazing US$681 and some guava pastries. Airfair should be around US$300. That, plus hotel should come in under the amount pledged so far. I'd still like additional pledges, however, I want to be certain we're covered and as an expression of the mood of the list. I intend to front the entire amount myself and then ask the "pledge partners" for a pro rated payment based on the actual cost and their proportionate pledge amount. It's interesting to me that several pledges have come from list members who are far removed from San Francisco. One or two of them plan to attend Dimitri's meeting, but most just want to have it happen. I've only had one request for anonymity, but I have kept names confidential without a clear go-ahead from them. (If you have already pledged or pledge in the future, please let me know if you mind if I post your name/nym.) Now there's only one thing missing--Dimitri's response. My open letter to him contained an explicit and unambiguous invitation to address a Cypherpunk meeting on any topic he wanted. I asked him for a clear yes or no, but have received nothing. Perhaps Dimitri prefers shooting from ambush. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 6

[Repost] PipeNet
by Lucky Green 17 Dec '03

17 Dec '03

Below is a repost of the original PipeNet article from February, 1995. The author is Wei Dai. -----BEGIN PGP SIGNED MESSAGE----- A week ago I made a suggestion for a new protocol for untracibility, but only got one response. I'll try again, this time more forcefully. I'm not trying to convince anyone to implement this (though of course you're welcome to!), but just to think about it and give me feedback. Why is another protocol needed? Right now we have only two, each of which has its own set of tradeoffs. To summarize: Mix-Net (i.e., remailer-net): high latency, moderate bandwidth costs, and low complexity DC-Net: moderate latency, high bandwidth costs, and high complexity While the DC-Net will probably never be widely used, the remailer-net has a fair chance of one day providing a way for many people to send e-mail that not even governments can trace. However, I don't think this is enough. Efficient social and business relationships require that people be able to converse to each other in real time. Cryptoanarchy will not come about if people cannot do this anonymously. How well can two pseudonymous agents negotiate a contract if each message they send must be delayed several hours? The protocol I sugguested would have low latency, moderate bandwidth costs, and moderate complexity. It would be well suited for people to interact anonymously in a textual environment. This is what I wrote: > Imagine a server that allows you to open a > low bandwidth (let's say around 100 cps, in order to reduce costs) > link-encrypted telnet session with it, and provides you with a number > of services, for example a link-encrypted talk session with another > user. You'll need to maintain the link 24 hours a day to defend > against statistical analysis, and of course you can chain a number of > these servers together in a way similiar to chaining remailers. Lance pointed out the chain cannot be built quickly. This is not a problem if servers connect to each other with relatively wide link-encrypted pipes and multiplex your connection into these pipes. In this system, latency would never be more than a few seconds, bandwidth cost is N*100 cps (point to point), N being the number of links in your chain. Implementation would probably be harder than remailers, but much easier than DC-Nets. The protocol would also provide both sender and receiver untracibility without any need for broadcasting. Wei Dai P.S. I never gave a name for the protocol... let's call it Pipe-net. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzgewDl0sXKgdnV5AQGzvAQAgFaOxOzFPgS031z4jZRYUJp/+3BS5Con Kza7WsvZPvxzaNLh9ecD3aCx5dtf4muaiUKjC2HIItaLKEdZZPdzUGFd4wg1cY8G k8mvYNzDImr3ZtQ0HiqQ59PWhznad0GuhjQajB7RtpI+K/Z4uBaUEZGVoZZT+LHN MSjOl/k/yfg= =jgq6 -----END PGP SIGNATURE-----

1 0