- cypherpunks-legacy - lists.cpunks.org

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by jim bell 17 Dec '03

17 Dec '03

At 04:28 PM 10/13/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >It is unpublished, but he kindly allowed to me describe it in a paper I >wrote that discussed whether a bank would ever want to take the risk of >allowing bank accounts where it did not know the identity of the customer. Why should that be a problem? It's the customer's money, isn't it? It's not like the bank is making a loan. It's the customer who should be worried...about the bank's identity. Remember "plausible denial." Shouldn't we believe that if a bank cannot know its customer, likewise it isn't responsible for who that customer is? A bank's legitimate interests should not include acting as enforcer for the government, so any system that prevents this from happening is helpful. And I don't think that a bank can ever be embarrassed (assuming bank accounts are anonymous) by it being revealed that some particular bad guy kept his money there, any more than other cash-based (anonymous) businesses are embarrassed if it is revealed that some bad guy used their services. Jim Bell jimbell(a)pacifier.com

4 6

RE: Re: extortion via digital cash
by scottb＠aca.ca 17 Dec '03

17 Dec '03

---------- >From: azur >Subject: Re: extortion via digital cash >Date: Tuesday, October 15, 1996 2:18PM > <SNIP> >Although Digicash's ecash offers anonymity to the payor it does not to the >payee. The reasons have to do with the way coins are blinded. So LE >could, with the bank's cooperation, easily associate the two sides of a >transaction. This was intentional on Chaum's part, either for moral or >practical political considerations. Its probably only a relatively minor >patch to allow one ecash purse (the kidnapper's) to generate the blind >token values so that another (similarly patched) purse (the vicitim's) can >submit them to the mint and return the minted coins to the kidnapper (e.g., >by posting on a popular Usenet group). In this scenario the only >reasonable way left to track the money is via linkage (the size and timing >of deposits and withdrawls in the kidnapper's account). I would tend to think that if you held on to the money long enough, you would thwart them tracking it via linkage-especially once it becomes more commonplace to do electronic transactions on the Net. Actually, if you wait long enough, you likely will run the risk of there being a crackdown on nym servers, remailers, etc, and maybe even specialy designed cancel-bots on usenet. /sb

1 0

SUN_syn
by John Young 17 Dec '03

17 Dec '03

CIAC Bulletin H-02 issues Sun's thumb-busting god-dam-its for SYN flooding: ============================================================================= SUN MICROSYSTEMS SECURITY BULLETIN: #00136, 9 Oct 1996 ============================================================================= BULLETIN TOPICS In this bulletin Sun discusses the TCP-based "SYN flood" denial- of-service attack. We suggest ways to tune most Solaris/SunOS systems to make them more resistant, and explain which releases and configurations stand up best. We also discuss which customers are most likely to be affected, and the degree to which firewalls and similar insulating arrangements can protect an enterprise from this attack. This Bulletin also describes the patches and other changes Sun commits to making in the future in response to the emergence of such attacks. This denial-of-service attack, which affects all operating systems which implement the TCP protocol, has previously been discussed in CERT(sm) Advisory CA-96.21, issued on 19 September 96. Attacks against several prominent service providers have been well documented in the last several weeks in Time magazine, the Wall Street Journal, and many other national and international periodicals. I. What has Happened, Who is Affected, What to Do II. Understanding the Vulnerability III. Technical Recommendations IV. Plans and Schedules APPENDICES A. Queuing Capacity Vs. Attack Rates B. How to obtain Sun security patches C. How to report or inquire about Sun security problems D. How to obtain Sun security bulletins or short status updates ----- http://jya.com/sunsyn.txt (48 kb) ftp://jya.com/pub/incoming/sunsyn.txt SUN_syn

1 0

Comment on binding cryptography (2)
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

Adam Back wrote: >Hey Bert-Jaap, I had you down as one of the good guys, what caused you >to fold :-) It's nice to hear I was listed as a good guy. Maybe I can regain some credit if I explain why I co-published the binding cryptography proposal ;-). I haven't yet made up my mind how the crypto problems for law enforcement are to be addressed. It's my Ph.D. subject, and all I can say at present is that the issue is complex. That is why I want there to be as much information on the issue as possible. I don't say I agree with key-escrow, GAK or binding crypto, nor with demanding a suspect to decrypt, but I want to know all there is to know before I make up my mind. Having a new proposal helps putting things into perspective. At least the binding crypto proposal shows (as other proposals have) that there's no need to escrow your private keys, and that's a point. Also, as I said in my first comments, binding crypto isn't meant to solve the crypto problem, it is "merely" meant to provide a trustworthy crypto system with some safeguard. Finally, to my mathematician's sense of aesthetics, binding crypto is an elegant proposal. It merits publication in its own right. Not because I think it should be established, but because I think it should be known. Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

1 0

New On WWW.Infowar.Com Vol.1 Issue #2
by Betty G. O'Hearn 17 Dec '03

17 Dec '03

*******New On WWW.Infowar.Com Take a look. Pass it on.******* * Secretary Perry announces WHY MICROCHIPS CREATE MEGABANKS * From ENN: DOD's Anti-Terrorism Conference Ft. Walton Beach, FL * Secretary Perry announces DOD to drop torture from training * Congress Acts!?!? The complete text of the `Industrial Espionage Act of 1996' * "The fictive environment of DoD infowar kooks" * Call for Papers "Funding Opportunities in Information Technology,Culture, and Social Institutions" * "Cybergangs" On the Internet * Ft. McClellan General Announces Reserve Bio-War Unit * Call for Papers 1997 IEEE Symposium on Security and Privacy _______________________________________________________:) Comments? What would YOU like to see? Write to: list(a)infowar.com Coming Soon: New Discussion Group on IW ( the first of several new discussion groups) _______________________________________________________:) Infowar.com Managed by Winn Schwartau winn(a)infowar.com http://www.infowar.com 813-393-6600 Voice 813-393-6361 Fax _______________________________________________________:) Content or Sponsor Opportunities ? betty(a)infowar.com 813-367-7277 Voice 813-363-7277 Fax _______________________________________________________:) The Global Clearinghouse for Information Warfare and Information Security on the Internet. We thank our sponsors: National Computer Security Association OPEN SOURCE SOLUTIONS, Inc. New Dimensions International - Security Training

1 0

Japan imposing crypto export restrictions!
by nobody＠replay.com 17 Dec '03

17 Dec '03

Another Cypherpunks exclusive! Bowing to US pressure, the Japanese Ministry of International Trade and Industry (MITI) has quietly made changes to Japanese crypto export regulations. In the past, export of crypto products from Japan was unregulated. The exporter had to file a pro-forma export declaration with MITI. The new regulations, imposed in recent weeks without public announcement, require the exporter to state the ultimate recipient of the crypto product. MITI then conducts a lengthy approval process that can take many weeks. It is widely assumed that the US used the thread of trade sanctions to bring about this 180 degree turn in the attitude of the Japanese government. The new regulations apply to exports from Japan to all countries, including the US. --anon

3 2

Censorship-related Web Sites?
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One of the professors in a different department is going to be doing a symposium next week on censorship, with particular attention paid to censorship and the internet. She has asked me to whip up a quick web page of resources that she can direct the participants too. Unfortunately, beyond the basic (EFF, ACLU, CPSR) sites, I really don't know of many good places to add in, and lack the time to do a thourgh search. If you know of a site or three, can you take a moment to drop me an email with them? Would save a lot of time. Thanks so much. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMmUM/TokqlyVGmCFAQFDawQAq3lMBg39gyDOwl/DW9GWeImui9S3ZnrJ 8YbNoqbcFWb+yAl9YOInp323nb9adh8D4zlvsyrs2+ZyziFMePyOkLLKO5K1kg5+ +ome1aLifyinjAHBGRLjbHMTU2vSP0znJeZzFZ65Q/z/ggucrXzN+gkwJbeeScad ztq8ZAHdOo4= =c6+G -----END PGP SIGNATURE----- Robert A. Hayden hayden(a)krypton.mankato.msus.edu -=-=-=-=-=- -=-=-=-=-=- http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GED/J d-- s:++>: a- C++(++++)$ ULUO++ P+>+++ L++ !E---- W+(---) N+++ o+ K+++ w+(---) O- M+$>++ V-- PS++(+++)>$ PE++(+)>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++>$ e++$>++++ h r-- y+** ------END GEEK CODE BLOCK------

1 0

"Stopping Crime" Necessarily Means Invasiveness
by Timothy C. May 17 Dec '03

17 Dec '03

There are several swirling threads about the development of crypto systems (e.g., "binding cryptography," "key recovery," "one-way traceable e-cash") that are designed to allow law enforcement some ability to track illegal transactions, catch some criminals, etc. Lucky Green and I had a brief discussion of this at my party last Saturday. Specifically, about the reasons some folks are avoiding "true" digital cash, as described in Chaum's papers of the mid-80s, in favor of "crippled" digital cash. We both agree that _any_ system which allows government to act to trace a transaction, or to trace a message, or to gain access to keys, essentially throws away the liberty-enhancing advantages of cryptography completely. That this is so, logically, is almost completely self-evident. If this is not, ask yourself whether the government of Myanmar, known as SLORC, would not use its "Government Access to Keys" to round up the dissidents in the jungle. Would Hitler and Himmler have used "key recovery" to determine who the Jews were communicating with so they could all be rounded up and killed? Would the East German Staasi have traced e-cash transations? For every government extant on the planet, even apparently benign government such as that in the Vatican (*), one can easily think of dozens of examples where access to keys, access to diaries, access to spending records, etc., would be exploited. (* And speaking of the Vatican, there's that little matter of Michael Sindona, Banco Ambrosiano, links to CIA funds in BCCI, and the body found swinging from the bottom of Black Friar's Bridge in London. They're just another power player, with a lot of interest in financial matters. Some say the whole "confession" system worked for a millenium as a surveillance and espionage system without peer.) Any proposal to force traceability of transactions must deal with this reality. What the government considers "criminal" or "suspicious" is often what they consider threatening to their exercise of power, or even of their particular time in power (e.g., the Democrats and their 900 FBI files circulating throughout the White House, looking for dirt on their "enemies," the Republicans. Do you really want Craig Livingstone having GAK?). The recent talk about "catching criminals" misses this point, that governments typically use surveillance powers to control citizens. (Note: I would think Dutch residents should be especially sensitive to this concern, given what happened to them in WW II, when the arriving Nazis used telephone records to locate Jews for extermination. Until recently, Holland had a tendency to carefully think about such issues---I believe phone calls were billed in such a way as to not keep such records, for example). Yes, true digital cash--the fully untraceable form originally discussed--will allow some new channels for criminal activity. Privacy has its price. The ability of people to plot crimes and commit crimes behind closed doors is obvious, and yet we don't demand secret cameras in homes, apartments, and hotel rooms! A point we often make, but one we should always remember. And full untraceability--the necessary criterion for something to be really called "cash"--also stops other kinds of crimes, particularly government crimes. As to fully untraceable digital cash--the real e-cash--we may be the carriers of the torch for this. For whatever reasons, David Chaum is backpedalling on his original points, and is making pro-traceability noises. However, various persons on this list have pointed out that "coin mixes" and other such methods can restore the full untraceability even of Chaum's present system. So, there is hope. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: binding cryptography
by um＠c2.net 17 Dec '03

17 Dec '03

> >Can you imagine that anyone would ever create a program that tries to > >look like a conforming implementation, but generates invalid "binding" > >data -- when it is so much easier to simply use PGP, and (if > >necessary) disguise that fact using the government-approved encryption > >software? I don't, so in my opinion the verification process is > >abolutely useless. > Can you imagine what would happen if governments would (help to) set up > a system that has no safeguards at all, i.e. that could give criminals > all the anonimity and confidentiality they need? Sorry if my formulation was unclear. I ment to point out that it is acutally easier to commit fraud in a way that is undectectable than in a detectable way. So on the assumtion that the concept of binding cryptography is a good thing, this scheme is flawed. But to answer your question: Encryption software has already been available for years. You may argue that PGP is not very user-friendly, but it is secure and every computer user who takes the time to read the manual can use it. So nothing much would happen that will not happen anyway or has already happened. > car, bicycle, house etc.). That is a fact of life; one I hate. So the > point is: where is the middle of giving up freedom and stopping > criminals? But since - as you admit - it is not possible to stop criminals, the question is: Do you want to cause a dramatic drawback in privacy and create new potential security hole just in order to force criminals to do a few hour's work of installing a secure encryption system from the Internet, or when that is illegal buy it on the black market? > We have set up the TRPs in such a flexible way that anybody could find > one he can trust, one might even set up his own TRP. Then it is not even necessary to use additional software to circumvent government access. The user can simply configure himself as TRP for the inner layer of encryption and the official one in the outer layer.

1 0

CyberPromo responds!
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A helpful cypherpunk provided a list of addresses for various postmaster and root accounts in cyberpromo.com. I am now sending my abuse response to wallace(a)cyberpromo.com cyberpr(a)ANSWERME.COM root(a)savetrees.com postmaster(a)savetrees.com root(a)answerme.com postmaster(a)answerme.com root(a)NS3.CYBERPROMO.COM root(a)NS4.CYBERPROMO.COM postmaster(a)NS3.CYBERPROMO.COM postmaster(a)NS4.CYBERPROMO.COM and it's actually generating responses. So far, Sanford Wallace has missed my point several times, assumed that I have been sending mail to the replybot when I have repeatedly stated the reverse, admitted that "someone is spoofing requests from your domain" and threatened to bill $1000 for "reviewing frivolous bills". It appears I at least have his attention. This is only slightly related to the list (via the redirection of the list to Wallace's replybot). If anyone wants to discuss CyberPromo tactics further, please do it via private mail. If enough of us want to talk about it, I'll set up a little list for the purpose. - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmVrMxvikii9febJAQGvBwP/WwtrXXFNWvJLIXYcIkrm12ZAaJZwn76e T6xY4IeJw5zYD73iYYYBcU4k6iR4GQR4ZRyKKRDKSqLXuXD0iXcrXG0LWoAtl/9w nKjPe83hiNYPCQIDwryTb3BZTkXBltTLh9VWjFSTMx7AbYg89mxvNrEPhbtevkIC TRwGZ7q2WF0= =TN2R -----END PGP SIGNATURE-----

1 0