- cypherpunks-legacy - lists.cpunks.org

Re: Rivest's Wheat & Chaff - A crypto alternative
by Dave Emery 17 Dec '03

17 Dec '03

There are two bills before Congress. One (HR2369) concerns radio signal privacy and restrictions on scanners and receiving radio signals without authority, the other (HR2460 and S493) concerns use of scanners to capture ESNs for the purposes of cloning cellphones. Both passed the House, and the anti-cloning bill also passed the Senate. On Mon, Mar 30, 1998 at 09:36:55AM -0800, David Wagner wrote: > > A bill banning mere ownership (and modification, sale, and so on; no need > for prosecutors to show any ill intent) of cellular capable scanners has > passed the House by a vote of 414-1. A very similar version also passed the > Senate easily, and the two are being reconciled. There's no opposition; > this is fasttrack noncontroversial stuff, on the Hill. I'm told the bill is > as good as signed. > That is not my information. HR2369 (the Tauzin bill) does not ban mere possession of cell capable scanners. It bans manufacture, assembly, sale, import, export, or distribution of *any* radio equipment (not just cellphone capable scanners) "intended" for the unauthorized receipt, interception, or divulgance of communications in violation of the amended section 605 (which bans interception or divulgance rather than the previous *and* divulgance). This very clearly does not ban possession, and also very clearly speaks to intent. What this draconian language means with respect to a wide band radio receiver such as a scanner that can tune in certain signals it is not legal to listen to is not clear at the moment, as it turns on what "intended" means. Penalties for violation of this are 5 years in jail and $500,000 fine per sale... (the law was basicly expanded from one forbidding the sale of satellite TV piracy gear - and similar language has been the law since 1988, but less clear). According to Thomas and my other sources, HR2369 is still in the Senate Commerce Committee and has not been marked up - apparently Sen Hollings of SC has put a hold on it for further study. There is a bill (S493) which establishes 15 years in prison for "knowingly and with *intent to defraud* uses, produces, traffics in, has control or custody of, or possess" a scanning receiver "to intercept an electronic serial number, mobile identification number or other identifier of any telecommunications service, equipment or instrument. This later bill clearly concerns ESN theft for purposes of cloning, but it is broad enough so it conceivably might be applied to possession of radio receivers capable of capturing any kind of identifying information for any radio signal - but I think it is probably true that there would have to be a specific demonstrable intent to defraud demonstrated before a conviction under this language could happen. This bill is tough, however, and does provide for "forfeiture of any personal property used or intended to be used to commit the offense". S493 does make it illegal to merely possess "hardware or software, knowing it has been configured to insert or modify telecommunications identifying information associated with or contained in a telecommunications instrument so that such instrument may be used to obtain telecommunications service without authorization". No requirement of intent to defraud need be demonstrated here, but there is an affirmative defense "(which the defendant must establish by a preponderance of the evidence) that the conduct charged was engaged in for research or development in connection with a lawful purpose." This bill, is one of the first I know of to outlaw mere *possession* of software. And they can take seize your computer, your car, and Lord knows what else if they find the illegal software on your laptop hard drive. They need not prove you had any intention of using it to clone cellphones, just that you knew it was configured for illegal ESN alteration and you did not have it for "research and development in connection with a lawful purpose." To quote the Committee report on the bill... [S493} amends section 1029 of Title 18 of the United States Code, relating to fraud and related activity in connection with access devices. The bill amends subsection (a)(8) of section 1029 by deleting the `intent to defraud' requirement which exists under current law in order to prove a violation of that section. This section relates to persons who knowingly use, produce, traffic in, have custody or control of, or possess hardware or software which has been configured for altering or modifying a telecommunications instrument. As a result of the amendments made by the bill, in order to prove a violation of section 1029, law enforcement officials will no longer have to prove that a defendant possessing such hardware or software did so with the intent to defraud another person. The amendment to the statute is being made because law enforcement officials occasionally have been thwarted in proving true violations of the statute by the `intent to defraud' requirement. But as the hardware and software in question can be used only for the purpose of altering or modifying telecommunications instruments, persons other than those working in the telecommunications industry have no legitimate reason to possess the equipment. Therefore, requiring the government to prove an `intent to defraud' in order to prove a violation of the section for possessing this equipment is not necessary. By eliminating this requirement from existing law this bill will make it easier to obtain convictions against criminals who possess this equipment before they actually use it for illegal purposes. ............................. The statute, as amended, also does not prohibit persons from simply possessing equipment that only intercepts electronic serial numbers or wireless telephone numbers (defined as `scanning receivers' under section 1029, as amended by the bill). For example, companies which produce technology to sell to carriers or state and local governments that ascertains the location of wireless telephones as part of enhanced 911 services do not violate section 1029 by their actions. Under new subsection (a)(8), however, it will continue to be illegal to use, produce, traffic in, have custody or control of, or possess a scanning receiver if such act was done with the intent to defraud another person. This also is current law, and it remains unchanged by the bill. > > The law enforcement industry couldn't care less whether the cellphone > airlinks are private. All wiretaps are done at the base station or > inside the network, where no scanners are needed. > Sadly, this is only true of *legal* wiretaps by authorized *US* entities. Ask any of the dealers and manufacturers of cellphone interception gear and high end scanners who buys this stuff (with cell phone band enabled). Lots of LEA types have this gear, some of which is specialized enough so it could have no other purpose. > I suspect the cellphone industry wants these laws primarily because they find > them useful at fighting fraud. When you broadcast a reusable "password" > (the MIN/ESN pair) over the air in the clear (as analog phones do), devices > to snoop on conversations start to look very much like devices to steal those > valuable "passwords". Of course. They could care less about privacy (or they would have encrypted years ago), but fraud costs them big money. > > Of course, we all know that these laws are pretty ineffective at protecting > privacy, though they are effective at making it easier to snow the public into > thinking their cellphones are secure. (This is only, what, the fourth such > law? It just gets worse and worse.) -- Dave Emery N1PRE, die(a)die.com DIE Consulting, Weston, Mass. PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2 5D 27 BD B0 24 88 C3 18

1 0

Re: Government: Home-Business
by Bill Stewart 17 Dec '03

17 Dec '03

>>Dear Friend, >>Thank you for your interest. Please take a minute to read this >>important information or simply print it out. > >>All the information here is 100% accurate and can be verified >>with the Department of HUD in Washington D.C. Bwa-hah-hah fnord.... >I'm getting more and more of this kind of crap sent to me. I have >a procmail script which greps a file of undesirable addresses I've >compiled, but that hasn't proven very useful as there aren't many >repeat offenders. (the procmail script is available at >http://www.universe.digex.net/~mbr/unix/junkmail.html) >How are other people dealing with this? So far, I've been sending them my offer for SPAM PREVENTION CONSULTING! at my usual rates of $250/hour, minimum 2 hours, plus any legal and collection fees required. One of them has a human reading the responses (the CHAG folks), who's not highly impressed (:-), while the folks with the hundreds-of-thousands-of-spam-victims-email-addresses lists have only robo-replied, though they've both sent a second set of spam and are thus billable :-) I assume, since the robo-spammers are posting from a new email address this time, that either their previous ISPs have dumped them, or perhaps that they're using the same ISP and multiple domain names to hide it, probably the former. CHAG is more blockable, since they're trying to portray an image of stability and trustworthiness, as opposed to hit-and-run. Meanwhile, large numbers of replies can always get their attention; I haven't tried forging the address of the robo-spammers' robo-reply-bot on a message to them to see if it knows not to spam itself, but if a thousand people were to do it, they might start to think it was a movement or something..... # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: Reasonable validation of a software package
by David Sternlight 17 Dec '03

17 Dec '03

At 1:12 PM -0700 7/18/96, Carl Ellison wrote: > >The problem people overlook is that a CA binds a public key to a name but >the name is in the CA's name space. For me, a verifier, to derive any >value from a certificate binding (key,name), the name has to be in *my* >name space. > >If there were such a thing as a global namespace meaningful to everyone, >then we could both use it. That's the X.500 falacy/pipe-dream. Think of the common name on a certificate as if it were a first-come, first-served serial number of alphanumeric form. There's no reason to believe that John Smith is YOUR John Smith. Your John Smith might tell you he's John Smith 37. It's kinda like vanity license plates. The alternative is every privacy fan's nightmare--embedded SSNs or some such in certificates. Some of the problems, of course, will be of the users' own making and there they get to pay their money and take their choice. What I mean is that you can optionally include or suppress your e-mail address in Type I certificates, and real address in Type IIs. If you include it you improve the chances of being the "right" John Smith someone is after. If you prefer privacy you will also be less accessible. I see nothing unusual about that--after all, people with unlisted phone numbers are ultimately inaccessible except (pretty much) to those to whom they give the info. > >The fact is, no global name space could be held in one human's mind, so >there's no way a global name space could be meaningful to me. Nor is there any reason it should be. It isn't, now. > >So, to use a certificate from a CA, I need to map a name from its name >space (DN) into a name in my name space (nickname). Every time I've looked >at that process, I've had to have a secure channel over which to learn from >the person I call by that nickname what DN he goes by. Why does it have to be a secure channel? Why can't it be published (for instance by including the address in the certificate)? >If I have that >secure channel, then he could tell me his public key fingerprint ove that >cnnel -- and I wouldn't need the CA. Why wouldn't you use the certificate to bind the public key to the name and address? What need would there be for fingerprint communication? How is this different from 20 John Smiths in the phone book at 20 different street addresses? I'd better know the address of the John Smith I want if I'm to get his phone number from a directory. Note that I'm not attacking what you say. There's clearly something you're getting at that I don't understand--since you post sensible stuff (as far as I recall). Help me out here. David

1 0

Re: How I Would Ban Strong Crypto in the U.S.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:29 PM 7/16/96, Declan McCullagh wrote: >(Note that Leahy is only occasionally a friend of the Net. His original >crypto bill had troubling additional criminal penalties; he shepharded >Digital Telephony through Congress; he is a co-sponsor of the vile >copyright bill pending right now. In sum, he'd hurt the Net more than help >it. This becomes a problem when netizens hold him up as an champion of our >freedoms -- and then when DT II comes along his fellow senators think it's >okay to vote for it 'cuz Mr. Net, Leahy, is a cosponsor.) By the way, I certainly don't hold him up as a champion of views I can support; I vividly recall his role in the disastrous DT Act. >My rebuttal to Gorelick's fantasy is: well, what about Japan, where the >country's constitution forbids wiretapping? Many countries have constitutions which say fine things, even though the reality is quite different. Some even constitutions which are in many ways better than the U.S. version...until of course the reality on the street is taken into account. Japan has an active SIGINT capability, called Chobetsu, directed domestically at U.S. installations (a la NSA's own SIGINT facility at Misawa AFB) and at domestic companies. Whatever their constitution may say, intercepts are used. Chip companies with facilities in Japan communicate with their facilities with the expectation that MITI and Chobetsu are making all attempts to intercept useful economic intelligence. Information on the intelligence agencies of various countries may be found in the standard reference by Jeffery Richelson, or on the Web at such URLs as http://www.onestep.com/milnet/iagency.htm Here is one entry for Chobetsu: Chobetsu Ground Self-Defense Forces Investigation Japan Division, Second Section, Annex Chamber In short, I don't believe that a New Crypto World Order, with buy-ins already apparent from most European and Asian countries, will be deterred by Japan's nominal promise in its constitution not to wiretap. As a friend of mine who spent the last nine years working for an American chip company in Tsukuba and Tokyo puts it, "Japan is a fucking police state." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

US govt claims to want to combat "computer terrorism"
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Somehow, I suspect that their efforts will A: not include any non-GAKed cryptography involvement, and probably minimal GAKed cryptography - less chance of someone using superencryption in a hard-to-detect fashion. I also suspect that they'll be cutting down on anonymnity, or at least trying to. Notice the link to an almost completely unrelated incident, namely the Oklahoma City bombing. -Allen > _ Wednesday July 17 1:28 PM EDT _ >U.S. urges "Manhattan Project" for cyber security > WASHINGTON - The Clinton administration is urged U.S. industry to join > in a sweeping new drive to protect computer networks and other modern > lifelines from attack by terrorists and others. [... Jamie Gorelick, or whatever her name is (yes, the pro-GAKing one), said:] > "What we need, then, is the equivalent of the 'Manhattan Project' > for infrastructure protection, a cooperative venture between the > government and private sector to put our best minds together to come > up with workable solutions to one of our most difficult > challenges," she told the Governmental Affairs permanent > subcommittee on investigations. > President Clinton set the stage for such a blitz Monday with an > executive order setting up a blue-ribbon panel that will recommend > measures to safeguard such lifelines as telecommunications, power > systems, water supply, and gas and oil storage and transportation. The > panel is to be chaired by a presidential appointee drawn from the > private sector and will include representatives from government and > industry. [...] > The administration began to focus on the issue after the April 19, > 1995, bombing that killed 168 people in an Oklahoma City federal > office building. > Copyright, Reuters Ltd. All rights reserved

1 0

The Orchid Ring of (Probable) Child Pornographers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:29 AM 7/17/96, John Young wrote: > "16 Indicted On Charges Of Internet Pornography." > > Exon-Reno-ing into one of the more distant frontiers of > sexual crime, a Federal grand jury charged 16 people in > the US and abroad with joining in a pornography ring. > Its members shared homemade pictures, recounted their > sexual experiences with children and even chatted > electronically as two of the men molested a 10-year-old > girl. The case appeared likely to heighten concerns > about the spread of child pornography over the Internet. This incident happened very near me, in Greenfield, California, near Salinas. (No, I was not involved!) Apparently the "Orchid Ring" (or "Orchid Club") was using a password-protected system of some sort, according to an article in today's "Mercury News." The Internet was used, but I don't know the details (e.g., whether IRC was used, ordinary e-mail, or some soft of "intranet" linking the participants). ObList Relevance: Even if they were not using PGP or the like, it is not a leap to imagine the usefullness of crypto for such intranets. It'll be interesting to see how this unfolds. BTW, from the reports it appears likely that these were indeed "child pornographers," not simple violators of the CDA. That is, full-fledged Horsemen of the Infocalypse. As such, potentially powerful ammunition for those who would like restrictions placed on crypto. (Especially if it turns out that law enforcement learned of the Orchid Ring through non-encrypted communications.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: New Infowarfare Panel
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:01 PM 7/17/96, Dave Banisar wrote: >If y'all have heard, Clinton signed an executive order 2 days ago creating a >new panel to examine how to "protect" "critical" computer systems. The panel >will be made of of the usual suspects with a non-govt person ($5.00 says it >will be someone from one of those wonderfully independant companies like SAIC, >MITRETEC, EDS, E-Systems). > >Needless to say, it looks an awful lot like NSDD-145 all over again with the >panel recommending changes to the law to allo for greater coordination of LE, >intell for govt computers and god knows what for non-govt computers. > >Anyway, the directive is now up on our site at >http://www.epic.org/security/infowar/eo_cip.html Thanks. It's certainly beginning to look like "infowar" is the new funding/legislation fount....I suggest it be given honorary status as a "Horseman." Winn Schwartau is running conferences, is talking about the imminent danger of the nation's computer networks being knocked out (paraphrasing his latest "Wired" item: "imagine your ATM network being knocked out and people being unable to gain access to their money"). Schwartau is predicting/advocating a "fifth branch" of the military to deal with the this threat. A cyberforce, as it were. Color me skeptical, but I see this all as a lot of hype and fear-mongering. Folks in the Pentagon, FBI, and NSA probably see it as a way to get more funding, Folks in the consulting business probably see it as a way to crank up the seminar prices and increase the number and frequency of "Information Warfare" workshops and seminars. And the anti-terrorism folks will use it to tighten up. (Of course, tonight's explosion of the TWA 800 looks to be a bomb, from all indications...this _could_ be the "Oklahoma II" incident that will trigger more draconian surveillance legislation. Just a concern I have.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 6

overseas PGPfone and Netscape
by Jean-Paul Kroepfli 17 Dec '03

17 Dec '03

I've seen some threads about (1) the new PGPfone, (2) the new US-version of Netscape and leakage. So my question: [Important] Do you know some non-US URL with the latest version of PGPfone for Win? (I monitored the usual European repositories quasi day to day, but it was always the old version) [Less important] Ibid. for the new US-Netscape (with full 128-SSL) (I suppose there is a copyright problem for such a -hum- mirroring) Best regards, Jean-Paul ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- Jean-Paul et Micheline Kroepfli (our son: Nicolas and daughter: Celine) eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr Also Compuserve and MSNetwork Phone: +33 81 55 52 59 (F) PostMail: F-25640 Breconchaux (France) or: +41 21 843 27 36 (CH) or: CP 138, CH-1337 Vallorbe Fax: +33 81 55 52 62 (Switzerland) Zephyr(r) : InterNet Communication and Commerce, Security and Cryptography consulting PGP Fingerprint : 19 FB 67 EA 20 70 53 89 AF B2 5C 7F 02 1F CA 8F "The InterNet is the most open standard since air for breathing"

7 10

Re:
by Arun Mehta 17 Dec '03

17 Dec '03

At 18:10 17/07/96 -0700, someone via anonymous-remailer(a)shell.portal.com wrote: >Does anyone know how to tanslate PGP into Burmese? I've been talking to human rights people here -- we certainly plan to translate into one or more Indian languages, and perhaps soon there will be action at an Asian level as well. Is this an urgent requirement? If so, I can try to arrange. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/

1 0

Systemics Announces First Internet Trading System
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 18 Jul 1996 12:48:03 +0200 From: Ian Grigg <iang(a)systemics.com> To: rah(a)shipwright.com Subject: Systemics Announces First Internet Trading System Systemics Announces First Internet Trading System 17 July 1996. Copyright (c) 1996 Systemics Ltd. 1996 could well be the year that marks the start of the Internet Financial System. Consider these developments: * Intense competition between rival payment systems has erupted as the large payment institutions have woken up - the new territory is on the Internet. * Earlier this year The Spring Street Brewery surprised Wall Street by conducting its own IPO - by the simple expedient of using the Web as a communication medium. After several weeks of hectic phone answering, CEO Andrew D. Klein realised he was in the wrong business and announced plans to start a new industry: Internet investment banking. * Across the pond in that other giant of international finance, the paperless trading system Crest starts up this week at the London Stock Exchange, signalling massive job losses. The exchange's troubles began late last year when exchange-member ShareLink was discovered delivering trading information on the Internet. The exchange severed ShareLink's "feed". Claim led to counter-claim, with litigation close behind, in a slanging match that ruptured images of the calm, polite English way of trading. Before saner heads could move in to force closed-doors negotiations, the palace revolution was underway. Suing one of ourselves? It's just not cricket. And now, Systemics Ltd has added in the last remaining ingredient, the Internet Stock Exchange. After a year of hectic, but secret, development by a small team of cyberventurers, the Exchange went live in June with Systemics own debt. A cohort of private investors were placed with Systemics bonds, which now trade on a nightly basis. Trades have been mostly small and experimental, as the investors, all computer professionals, get to grips with the new-found power of instant access to the 'market'. The Genesis of a new Financial System Ian Grigg, co-founder of the team, concentrates on the business aspects during the daytime, and in his spare time, helps with coding the market. "It seemed like a simple thing back then, take the basics of digital cash, add in securities, and build a market to trade the securities for cash." In the summer of last year, co-founder Gary Howland was working on digital cash protocols for DigiCash. Meanwhile the Internet was exploding into the public eye, as conventional media started to realise the potential of the new medium. Howland conducted long email discussions with his future co-founder. "There was this awesome potential energy, just sitting around in the digital cash concept waiting for chance to go kinetic." Grigg was attending lectures on Finance as part of an MBA from London Business School. "In the day time, I was learning the basics of what a bond was, and at night we would have these unlimited discussions on where the net was heading. With each lecture, each discussion, the feeling was getting stronger - we had the tools in front of us. We could build an Internet Financial System." The Systemics team aren't the only ones to have seen the potential. Bob Hettinga, a prolific net writer, had described the basic concepts as much as a year before. Grigg thinks that it took the combination of diverse skill sets and motives for ideas to turn into reality. "We're continually surprised that nobody else saw it and jumped in. But if you analyse the work that went in to the software and the building of knowledge in the core disciplines, it really is a major project that is too risky for any conventional company. I would guess it can only be done by a small, tightly focused team with key individuals. Or, by one of those great, wide ranging alliances that bring in diverse stake holders." The Internet Financial System will consist of Issuers, Payment Systems, Markets and Investors, just like in the physical world. An Issuer runs a special service suite on the Internet to manage the financial instruments. Those instruments are placed by the Issuer with a private group of Investors. Then, when the Exchange accepts the issue and runs a Market in that instrument, Investors can trade the instruments using Systemics Trader, a specialised browser. Instruments are bought and sold for digital cash, provided by an Internet Payment System. The Systemics team are proud of what they have achieved. Grigg explains: "The small investor gets direct access to the markets. Settlement is immediate - when the trade is done, the money or instruments are waiting for collection. And with the security of modern forms of cryptography, there's a lot of peace of mind. This Exchange carries no risk, which results in a cost to the Investor that is so small that it creates a new segment." Internet Trading Takes Off In the first instance, it was necessary to prove the system under real trading conditions. Systemics issued its own debt as one year zero coupon bonds with a face value of USD 10. Each of the investors was given a tranche at an issue price of $9, allowing investors to earn a dollar for every nine dollars invested over the full year. To manage the portfolio of cash and bonds, each investor downloaded Systemics Trader. On the 25th of June, the first live market was opened by the Exchange for the first investor trades. "Since then, we have gradually settled into a routine. The market opens at 1915 GMT, for a six hour trading session. This time slot seemed to give the best access for our investors, who are located in diverse time slots and daily patterns." Trades are not frequent as people who have never traded before get to grips with the concept. "Our investors are all long term associates who understand the future of the Internet. They were keen to invest in what we think is the most advanced project on the Internet today. For all that, trading got off to a slow start as investors proved initially timid at risking their own cash and bonds." However, within a week, the backers are showing all the signs of an aggressive investor community. "If they're not happy, they don't trade." Demands for additional instruments caught Systemics by surprise, as investors pointed out that without a comparison between instruments, there is no decision on value. "It's obvious in hindsight, there's a limit to what people can do in a one-bond exchange." The challenge now is to decide on alternative instruments. Secure Payments are based on Cryptography At another level, the Exchange is just a complicated shop on the Internet. It buys and sells financial instruments for cash, and relies on a secure value transfer system to make the trade. "When we laid down the strategic components a year ago, there was no sure availability of any payment system, let alone one up to the rigors of finance. So we had to do our own," said Howland. In a forthcoming paper, he describes a design for a digital payments mechanism built upon the cryptographic key format in Phil Zimmermann's Pretty Good Privacy, the Internet standard for email encryption and digital signatures. "PGP is the only system that is widely available and provides good security. The challenge was to turn it from a message passing system into a value passing system." The Systemics payment system works on the notion of a value-containing box that is controlled by a PGP key. A server holds the public key, anyone who has the private key can control the box. A box can be used as an account, allowing the conventional management schemes of accountancy to be used. In this case, the server ascribes value to the box, and the users write instructions to transfer value from one box to another. Or, it can be used as a coin, allowing cash emulation. In this case, users transmit secret keys, and coins are cashed in by issuing instructions to transfer the value in a received coin to a box account. Howland states that this design allows for immediate settlement in both financial instruments and cash, a critical issue in financial markets. Also, the use of PGP keys makes independant verification of the protocols a relatively low cost task by leveraging off of the enourmous amount of trust placed in PGP. Systemics believes in open cryptography. "We intend to publish all our protocols with example software, and our goal is to publish a complete and working payment system. Cryptography and digital payment mechanisms are socially beneficial and should be widely disseminated." Systemics have already published their Cryptix library, providing strong cryptographic solutions for Java and Perl developers. The Investor Takes Control Systemics Trader, the specialised trading browser, is written in Java. "As far as we know, this is the first serious application written in Java outside Sun itself," commented Mike Wynn, author of Systemics Trader. Working as an HTML browser, Systemics Trader can pass through firewalls set up to allow WWW browsing. This has doubled the potential user base; about half of Systemics' investors work on secure systems. Systemics Trader manages a portfolio of financial instruments and cash using a 'box' as a digital account. 'Limit' and 'Market' orders can be submitted, tracked and cancelled. The 'board' for market instruments can be monitored on an investor-demand basis, so as to present the latest prices to the investor. A secure registered mail protocol is used to ensure messages containing value get delivered from the Exchange to the investor. Given the vagueries of the Internet, Systemics Trader has to sign for each payment that is sent to it before the payment is considered to be delivered. Then, both parties to the trade know that the deal is done. Future versions will manipulate both digital cash and digital accounts, as well as multiple currencies. Real-time feeds are also a possibility. For now, however, Systemics is concentrating on building in the basic features and reliability that risking an individual's money will demand. Wynn's plans are oriented towards the developing a trading library that can be used as the basis for a whole class of browsers. "In the short term, our investors and testers are still proving the system for us. In coming weeks, we intend to release a new version of Systemics Trader for widespread demonstration purposes on our test markets." An Internet Team Systemics Ltd, an Irish company, holds the brand and fronts for the team in any formal discussions. But the real capital is in the heads of the many individuals who have contributed. Outside the tiny core is a small group of "insiders" who contribute ideas, software development and testing. And outside this group is the Internet software community. Enourmous amounts of freely available software have gone into the system, making the efforts of the group just the tip of the iceberg, and the core team just the bunch of penguins sitting on the tip. "We are an Internet team, not a company in some office. What some are calling the virtual company is really a series of concentric circles flowing out over the Internet. The pebble dropped in the centre of the well is the idea, the development waves move out and reflect back in to form the product. Think about Internet development as that big node where all the waves rush in to one point." Acknowledgements This information release from Systemics Ltd. Copyright 1996 Systemics Ltd. Free and widespread distribution is permitted, as long as attribution is maintained. Please point your readers at our home page: http://www.systemics.com/. This release will be located in docs/releases/1996-07-17.html Systemics, Systemics Trader and Cryptix are trade marks of Systemics, Ltd. The Spring Street Brewery can be found at http://plaza.interport.net/witbeer/ and Wit Capital at http://www.witcap.com/ ShareLink is at http://www.esi.co.uk/sharelink/. Also see InfoTrade http://www.infotrade.co.uk/. Bob Hettinga, prolific net poster, is at http://www.vmeng.com/rah/ or rather, his e$ homepage is. Subscribe to the e$ mailing lists for the latest digital cash gossip. Pretty Good Privacy and PGP are trademarks of PGP, Inc. Phil Zimmermann and PGP are thse days better found at their new corporate home: http://www.pgp.com/ Java is a trademark of JavaSoft, found at http://www.javasoft.com/ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0