- cypherpunks-legacy - lists.cpunks.org

Re: VME As AES?
by Bruce Balden 17 Dec '03

17 Dec '03

I don't suppose the instinctive avoidance of security by obscurity (validated by many problems in the past, especially the Enigma cipher used by the Wehrmacht) has penetrated the great cryptographic minds o Meganet? -----Original Message----- From: John Young <jya(a)pipeline.com> To: cypherpunks(a)toad.com <cypherpunks(a)toad.com> Date: Wednesday, December 17, 1997 12:13 PM Subject: VME As AES? >PR Newswire, December 17, 1997: > >Los Angeles -- IBM telephoned Meganet Corporation ten days ago >after reviewing the Virtual Matrix Encryption (VME) algorithm and >highly recommended the VME technology to be the national >standard for data encryption, reported Meganet. The IBM >spokesperson from the Security Technology Division requested >immediate submission of VME to the National Institute of Standards >& Technology and the Institute of Electrical & Electronic Engineers to >facilitate the standardization. Obviously, Meganet's claim that their >VME technology is completely impenetrable has garnered much >support. > >Source: Meganet Corporation. http://www.meganet.com >

1 0

Re: Can I do Pubkic Domain that -
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

As for me, posted MISTY source code from Japan. Why is it improper if permission isn't taken from NSA/Commerce Dept ? > >Are you looking for access to the MISTY source code? It's still illegal to >export it pending an appeal to the U.S. Supreme Court. Even if that appeal >fails, Congress will likely pass amended laws and/or the NSA/Commerce Dept >will issue revised regulations on the same day that an unfavourable decision >is announced. > >Those guys just never learn that not only is the barn door open, but that >contents were never theirs to begin with. > >-----Original Message----- >From: Nobuki Nakatuji <bd1011(a)hotmail.com> >To: cypherpunks(a)toad.com <cypherpunks(a)toad.com> >Date: Wednesday, December 17, 1997 6:22 PM >Subject: Can I do Pubkic Domain that - > > >>Can I do Pubkic Domain that I posted MISTY source code before? >> >> >>______________________________________________________ >>Get Your Private, Free Email at http://www.hotmail.com > > ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

e$: A prima facie business model for a digital cash underwriter.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 3:07 PM 8/27/94 -0700, Rick H. Wesson wrote: >I've finished implementing the GNU mp library in perl of which I've >already extended to work with an Object Relational Database. All this >together gives me very fast access to numbers in the order of 8192 >digets in base 36, geesh I have no clue as to how many base 10 digits that >is but I feel that its proabably enough to play with some digital cash >prototypes... Rick, I've been thinking a little about what we all may see as business models for e-cash use. The least complex model I see, and the one I like the most, is that people simply buy digital cash from an underwriter through a link to some off-net financial entity. NetBank uses a 900 number phone call which generates so-many netbux. My favorite one, and the one which may be most apprehendable to the public, is an ATM-card gate in which the purchaser swipes his card into a secure mosaic screen using a card reader at home (they're pretty cheap these days, and could get cheaper if this became prevalent). If the underwriter could assure the bank in some fashion (maybe it's the bank's gate?) that they can't "sniff" the card key/pin number, then the bank could simply authorize the generation of digital cash from the underwriter to the purchaser on a "pay ya later" basis . That is, the money would be forwarded by the bank from the purchaser's account to the underwriter's suspension account by wire or whatever, trade settled in same-day funds, of course. This is somewhat analogous to the way traveller's checks are generated now, in the sense that the bank functions as an intermediary (buying the checks on a discount, and selling them for a premium) to an underwriter (the issuer of the check). In our case, the bank is just referring a customer and collects a fee for each customer sent to the underwriter. Pricing of the cash at purchase will probably be based on a combination of discounting the costs of the operation of the underwriter, the commission paid to the "sponsoring" bank, and the returns from holding on to the cash in a suspension account (however small that may be). As is the case in traveller's checks, there isn't a fee for using them with a seller, and there are hardly any ID requirements, because the signature's on the check. I believe that a traveller's check is as good as cash at a bank, so the check is "loaded" like a mutual fund at the front of the transaction. In keeping with Eric's point for charging a fee to exit the net, we could also put an additional exchange fee (which would be figured into the same equation which generated the front end fee). The beauty of this method is that the underwriter need not keep any "account" data per se. It has a database of outstanding cash, and it simply honors outstanding cash coming in. When a double-spent digital bank note comes, then the protocol for identifying the double spender is followed, and it's up to the redeemer to settle up with that person. Having said all that, my question is, will your machine handle all the routine activities of an underwriter in the above scenario? We'll ignore interacting with banks for the time being, because that's done in the financial markets already, and interbank operations methods will be different for different underwriters anyway. That means anything put up on your spiffy Sparc machine and it's attendant code should be able to: 1. Generate to purchasers and take in digital cash from sellers. 2. Identify double spenders. That's it. That's obviously a tall order, as lots of people have said here more than once. 1.) It implies an interface to the customer who buys the digital cash which ensures privacy between a bank and a customer, even though an ATM swipe and a PIN goes through it. 2.) It implies a wallet and a register with which to transact business offline, with the assurance that cash is not accidentally double spent. 3.) It implies the managment of what may be a large database of unspent cash that's out there representing contingent claims on a suspension account. It probably also means the need to keep at least sample statistics on spent certificates so that they can be used to determine the longevity of a piece of cash on the net, so that proper management of the suspension account can occur. Obviously, you don't have all that stuff. More to the point, I think 1.) and 2.) above are already out there somewhere. But from talking to you, I'd also think that you have most of the foundation for 3.) taken care of. Obviously, the problems are in legal and regulatory issues, folks. Whoever's algorithm is used to gen up digital cash will want their piece from whoever underwrites digital cash. That's pretty straightforward. Pay them royalties. The banks are going to want to make sure that they get a piece of this, so that they don't disappear (fat chance!). Pay them comissions. Regulators are going to want make sure, well, I don't know what they're going to want, but it'll probably be silly. Given them what they want within reason. Then pay them taxes. If they ask for a total audit trail on off-line transactions, tell them it's impossible. If they forbid off-line transactions because of decreased tax revenue, show them the potential for increased taxes on your operation to make up for it, and show them that you'll follow IRS cash handling protocols just like banks do. Like I've said before, it's a rare parasite which kills its host. If somebody tries to send out a million-quarter attack, it's known how to detect it and to stop it. If someone gets away with it, it's known how to hunt them down and send them to jail. No matter where they are. The point is, we're closer to digital cash than we think. I think that estimates for the delivery of working code for all of the above are way overestimated. I think that the cost of regulatory compliance is way overrated, especially if banks can see a way to make a moderately risk-free living from it. I think the cost of catching a thief and proving he stole money is the same it has always been. I'll sit down now. ;-). Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: DSN authentication? (fwd)
by Lucky Green 17 Dec '03

17 Dec '03

Some of you may remember my post to the list a while back wondering which, if any, authentication is taking place on commands sent to space crafts such as the Mars Rover. Well, here is the official answer: "We use a private network and keep the protocol specs secret, therefore we don't have to worry about a thing". -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred ---------- Forwarded message ---------- Date: Wed, 17 Dec 1997 12:14:35 -0800 (PST) From: Public Info <info(a)deepspace1.jpl.nasa.gov> To: Lucky Green <shamrock(a)netcom.com> Subject: Re: DSN authentication? Dear Mr. Green: I now have a response to your questions of authentication from one of our Deep Space Network Operations Managers, as follows: The commanding of any spacecraft is performed via a closed and secured network not accessed by the internet or the public. Direct connections provided by NASCOM connect the DSN sites to the project operations centers. There is no other branches nor interconnections available outside this circuit. Each project center determines the bit structure of each command sent, and not even the DSN sites that transmit the commands are aware of the format, protocols, etc. Command data is not stored at the sites to avoid sending commands inadvertently to the spacecraft. As a matter of fact, DSN policy is not to accept responsibility for manually sending commands even in case of a disaster. And, even within this closed circuit, command data is given the highest priority and treated as sensitive data and the command subsystems receiving and transmitting this data have been classified with the with the highest NASA security level. I hope this answers your question. Thank you for your interest. DSN Outreach Office >What authentication methods are employed to authenticate commands sent via >the DSN to space crafts and landers such as the Mars Lander? Please be >specific. Algorithm names, key lenghts, protocol specs, etc. > > > >-- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred > > "I do believe that where there is a choice only between cowardice and > violence, I would advise violence." Mahatma Gandhi

1 0

IBM Abandons Cryptolopes
by Fisher Mark 17 Dec '03

17 Dec '03

CNET has the full story at <URL:http://www.news.com/News/Item/0,4,17474,00.html>. Apparently (IMHO), someone at IBM realized that Cryptolopes were isomorphic to copy-protection -- and we all know how much widely-available commercial software is copy-protected today (i.e. none to speak of). As a veteran of the copy-protection wars on the side of the bad guys (the copy-protectors), it is just impossible to fully copy-protect software given the current state of PC and workstation hardware (though I expect most of you already know this). I predict that if someone tries to add features to computers to make copy-protection more tamper-resistant, there will be a great groundswell of protest by the mass of computer users, both private and corporate. Only if such protection were mandated by government (a la Stallman's "The Right to Read") would this even be close to feasible. To close, a quote from Eugene Spafford: "The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards -- and even then I have my doubts." ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

1 0

Can't Find Your Web Site
by up＠uplinkpro.com 17 Dec '03

17 Dec '03

Can't find your web site? Uplink will post your site to 50 search engines for $89. We guarantee your satisfaction, or you pay nothing! Millions of people every day use search engines to find web sites. Uplink makes your site easier to find by posting it to the top 50 search engines. Here's how it works: 1. Fill out the form below, and return it to us. 2. We'll post your site to the top 50 search engines within two business days and send you a full promotion report. 3. Pay nothing now. We'll send you a bill for $89 with the promotion report. If you're not completely happy, simply write "cancel" on the bill, and you'll owe nothing. THE SEARCH ENGINES Here's the list of top search engines to which we'll post your site: Alta Vista, Excite, Galaxy, HotBot, Infoseek, Lycos, Magellan, Open Text Web Index, Web Crawler, BizWeb, New Riders WWW Yellow Pages, LinkMonster, True North, Northern Light, YelloWWWeb, The Weekly Bookmark, The Galactic Galaxy, TurnPike, Unlock:The Information Exchange, Your WebScout, Manufacturers Information Network, Net Happenings, Net Mall, Web World Internet Directory, WebVenture Hotlist, What's New, WhatUSeek, JumpLink, Linkcentre Directory, InfoSpace, Jayde Online Directory, BC Internet, BizCardz Business Directory, Net-Announce, New Page ListOne World Plaza, PageHost A-Z, PeekABoo, Project Cool, Scrub The Web, Seven Wonders, Sserv, Starting Point, Web 100, Web Walker, Where2Go, World Wide Business Yellow Pages, Wow! Web Wonders!, WWW Worm, JumpCity. ORDER FORM Hit the REPLY button on your e-mail program and fill out the following information. (This information will be posted to the search engines/indexes): URL: http:// Site Title: Description (250 characters): Key words (250 characters, in descending order of importance): Your name: Company Name: Address: City: State/Prov: Zip/Postal Code: Telephone: Fax: Email address: Contact e-mail address (in case we have questions about this order): If billing a different address, please complete the following: Addressee: Company Name: Address: City: State/Prov: Zip/Postal Code: Telephone: Fax: Email address: TERMS Terms are net 15 days from date of invoice. ______________________________________________________________________ Uplink, Inc. 39B Mill Plain Road Danbury, CT 06811 Phone: (203) 791-7351 Fax: (203) 790-6407 E-mail: up(a)uplinkpro.com

1 0

Crescendo News - Version 3.0 now available
by LiveUpdate News 17 Dec '03

17 Dec '03

You're receiving this email because you downloaded Crescendo in the past, and we want to keep you posted on the latest developments here at LiveUpdate. We hope you are enjoying Crescendo! In case you haven't already heard, Crescendo version 3.0 has been released. This new version includes cool new features like auto-detach, playlist support, encryption, Java and JavaScript programmability and more. Download a copy today from http://www.liveupdate.com/dl.html. As an added bonus at this time of release, and to ensure an enjoyable listening experience, we can now offer you, for a limited time, the Roland Virtual Sound Canvas Music Pack (VSC-550W). This is Roland's software wavetable Sound Canvas and includes a complete set of software tools that will help you create and edit MIDI files for many uses. Included in the VSC-550W Music Pack: * The Roland GS software synthesizer, * Cakewalk Express music sequencing software and * DoReMiX unique music creation software all on one CD-ROM. The Roland Virtual Sound Canvas Music Pack sells regularly for $57. Add Crescendo PLUS for Netscape and Internet Explorer, and the entire package is worth almost $100. By special arrangement with Edirol Corporation (distributors of the Roland Sound Canvas in North America), when you purchase the Crescendo Plus Roland Edition today, you will receive all the above software listed for a special value price of only $65 (including Shipping & Handling!) Note: This offer is only available to addresses in North America. Simply go to http://www.liveupdate.com/soundcanvas.html and we'll send it right out to you! If you wish to be removed from this list, please send a message to newsletter(a)liveupdate.com. Warmest holiday wishes, Your friends at LiveUpdate

1 0

Re: message dependent hashcash => no double
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Steve Schear (schear(a)lvdi.net) wrote: >We all know we must affix postage to our snailmail. >Its time to embrace the postal system's paradigm and educate the reminder >of the Net. That's an extremely bad analogy; we're not paying for the Net to carry our mail, because we've already paid our ISP for that. We're paying for remailers to process our mail or for humans to read it. A better analogy would be for snail-junkmail to include a five dollar bill to encourage people to open it rather than junk it unopened. (Of course this really only applies to real digital cash, but that's what hashcash is a substitute for.) Mark

1 0

Re: Freedom Forum report on the State of the First Amendment (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 18 Dec 1997 19:08:31 -0700 > From: Tim May <tcmay(a)got.net> > Subject: Re: Freedom Forum report on the State of the First Amendment > This is part of why the First Amendment is being eroded constantly. It is > seen as a _political_ issue. > > Suppose RealBig Corporation fired Umbehr for his views. Would a First > Amendment issue have arisen? But Tim, governmental systems are *not* businesses, and should not simply as a matter of course be operated as such either. There is more involved than a simple bottem line. Perhaps you should talk to Horatio... ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Censorware Search Engine update and request for files
by Declan McCullagh 17 Dec '03

17 Dec '03

Over at the Netly News Network, we've decided it's time to update our Censorware Search Engine. For those of you who haven't checked it recently, it's a one-of-a-kind web site that lets you see if you've been blocked by filtering software: http://cgi.pathfinder.com/netly/spoofcentral/censored/ We're planning to update this with newer decrypted lists from some of the vendors like SurfWatch, CyberPatrol, and so on. If you have a list and you'd like it to be included, please send it along. -Declan

3 5