Tim May <tcmay@got.net> writes: [ Ryan Lackey on proposed hardware setup for his Eternity DDS ]

Will these be located in the U.S.? Will their locations be publicized? Will any offshore (non-U.S.) locations be publicized?

Any file system which can be identified as to *location in some legal jurisdiction*, espeically in the U.S. but also probably in any OECD/Interpol-compliant non-U.S. locations, will be subject to COMPLETE SEIZURE under many circumstances:

* if any "child porn" is found by zealous prosecutors to be on the system(s)

I think child porn is pretty much the canonical example -- the spooks / feds have a history of posting their own child porn if none is available to seize. (eg The Amateur Action BBS case which Tim cites classic case -- the Thomases had not had any dealings with child porn, but a US postal inspector mailed some to them, and busted them for it before they had even opened the package. They are still in jail now.) An article which got forwarded to cypherpunks a while back was a URL for some people who had created a for-pay web service which consisted soley of hypertext links to child porn articles in usenet. I never did investigate (the worry is always that it is a sting in itself, and I was interested in the techniques not the material), but it is interesting that these people considered this action safe enough for the monetary rewards to compensate. (Anyone save this post / URL, or know if these people are still in business, or what technique they used to be able to generally link to USENET articles... is it possible to link to news:alt.anonymous.messages/message-id in a way which is independent of news spool?) I agree with Tim that actually building distributed file systems where data can be traced back to the server serving it will cause problems for the operators. I think even if there are many operators, and even if the data is secret split, the operators would likely be held liable. Ross's paper describes some techniques for building a distributed database which makes it difficult for a server to discover what it is serving. (Necessary because an attacker will become a server operator if this helps him). The threat of seizure is the reason that I focussed on using USENET as a distributed distribution mechanism. All sorts of yucky stuff gets posted to USENET every day, and USENET seems to weather it just fine. The idea of using new protocols, and new services as Ross's paper describes is difficult to acheive a) because the protocols are more complex and need to be realised, and b) because you then face deployment problems with an unpopular service and supporting protocols who's only function is to facilitate publishing of unpopular materials. So I focussed on USENET, but the weakness of using USENET for building a distributed database where data is intended to persist for protracted periods of time is that USENET articles expire, existing in news spools often for only 3 days or so. The problem is really that USENET is essentially a distributed _distribution_ mechanism, and not a distributed database. Archiving USENET as a separable enterprise which charges for access (altavista for example charges via advertisements) seems less problematic than directly trying to build a database of controversial materials. Archiving it all partly reduces your liability I think, because you are not being selective, you just happen to have a business which archives USENET. However there are two problems with this: a) volume -- USENET daily volume is huge; b) the censors will ask you to remove articles they object to from the archive. The solution I am using is to keep reposting articles via remailers. Have agents which you pay to repost. This presents the illusion of persistance, because the eternity server will fetch the most recent version currently available in the news spool. This avoids centralised servers which would become subject to attack, all that is left is a local proxy version of an eternity server which reads news from an ordinary news spool. My current implementation is a CGI binary which is currently running as a remote eternity server. You can run it as a local eternity server if you have a local UNIX box, running say linux. Better would be a more general local proxy for other platforms. I am working on this local proxy version at present. This is the state of play for me. The reposter will be either the publisher of the article, or a reposting agent. In either case remailers can be used. Remailer resistance to attack has improved a lot since some of the remailers started using disposable hotmail etc accounts as exit nodes -- the remailer is no longer traceable without a much higher resources being spent by the attacker. Using a chain of mixmaster remailers, and a remailer using hotmail for delivery provides good anonymity.

I would have thought that a much more robust (against the attacks above) system would involve:

- nodes scattered amongst many countries, a la remailers

Better to have no nodes at all, as with USENET only solution. The reposting agent (which may be the publisher, or interested reader if they are fulfilling the role of reposting agent) is a node of sorts, however this node can be replicated, can move frequently, and only ever need communicate via remailers.

- no known publicized nexus (less bait for lawyers, prosecutors, etc.)

This one is crucial.

- changeable nodes, again, a la remailers

- smaller and cheaper nodes, rather than expensive workstation-class nodes

- CD-ROMS made of Eternity files and then sold or distributed widely

This is an interesting suggestion, but surely would open the distributor up for liability, especially if copyright software were amongst the documents. Were you thinking of

- purely cyberspatial locations, with no know nexus

(I point to my own "BlackNet" experiment as one approach.)

This is the best option. Make it entirely distributed, so there is no nexus, period. cyberspacial -> meatspace mappings are often easier to trace than we would wish, especially where there is continued usage (for example there are various active attacks which can make progress even against mixmaster remailers). This is the weak point of my reposting agent, be that human, or automated. However anonymous interchangeable reposting agents is an interesting concept. One way to view the reposting function would be to view it as a new function for remailers; that they would post a message a specified number of times at specified intervals. However it is probably better to separate the function into a separate agent because remailers are known, and few in number. A reposting agent need never advertise an address. Instructions to the agent would be via USENET (it would read news for instructions and eternity documents bundled with ecash payment for it's services, and repost these according to those instructions). The reposting agents would be motivated by profit, have reasonable chances at obscuring their identity through the use of remailers, and so would be willing to take the risks. A smart operator could further reduce risks by using resources intermittently and unpredictably, and by using multiple, automated entry nodes into the remailer net. Potentially agents could be left operating in cracked accounts, siphoning payments off to their owners, at fairly low risk to the owner. Agents could be rated for reliability in delivering services paid for, or payment could be enabled for each repost by a arbitration agent upon seeing the post.

It is also likely in the extreme that a working Eternity service will quickly be hit with attackers of various sorts who want to test the limits of the service, or who want such services shut down.

I agree with this prediction. Remailers have seen this pattern, with `baiting' of operators, and apparently people posting controversial materials and reporting the materials to the SPA or others themselves, etc. As you might guess part of the above are unimplemented. The local proxy is my current task. Reposting agents are unimplemented, as is integration of payment. Another comment is that reader anonymity is a separable aim which should be cleanly separated from the design. Services like anonymizer, crowds, pipenets, SSL encrypted news server access (supported by netscape 4), and local news feed can ensure anonymous access to eternity document space at varying cost trade-offs. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

My comments below are not meant to cast doubt on Ryan Lackey's scheme, but just to raise some questions. I am surprised, I have to admit, that Ryan is talking so much about raising money, getting investors, etc., when no _working model_ of his scheme has been deployed for people to play with, find weaknesses in, etc. (In comparison to, say, remailers, which have existed for more than five years now, with literally thousands of articles--some good, some bad--written about them in all of their various facets. Even specialized lists for remailer operators, Mixmaster-type remailers, etc. And yet there have been no serious calls for investors to pour money in.) Frankly, in reading Ryan's summary, including assertions like "In my system, no one knows (ideally) who is actually storing the data, only those on the edges of the system (who will hopefully only be known by a logical address)," I find no real discussion of the *core idea*, the _reason_ his data base is in fact secure. (I apologize if a full discussion is contained in his earlier documents. Even if his earlier documents had a fuller description, there has certainly been an almost complete lack of discussion of his system here in Cypherpunks. Given the additional complexitities an Eternity type data base has over something as conceptually simple as a remailer, the lack of discussion is not confidence-inspiring that Ryan somehow got it all right.....) Anyway, I can think of all sort of threat models, and ways of (maybe) attacking any system of linked machines I can think of, except ones using message pools (which is why I'm biased in favor of Blacknet, I suppose). (The motivation for Blacknet was to a) demonstrate message pools, b) show that anyone could be a node, c) build a system where the links between nodes are all of the traffic in "speech space," and that so long as encrypted messages could be posted in speech space (Usenet, boards, etc.), then the system could not be shut down. Basically, to stop Blacknet one would have to ban remailers in all jurisdictions, or ban speech coming from certain jurisdictions. Otherwise, it's too distributed to stop.) (Note: But Blacknet has long latency, derived from its "speech" underpinnings. There is the temptation to go to faster links, to move away from speech space into traditional network links. But this reduces the number of nodes and links, and makes an attack on the reduced-but-faster network no longer equivalent to interfering with free speech. A technological win but a political lose.) Until we see a mathematical model--forget the details of implementation, the epiphenomenal stuff about Oracle, AOLServer, Alphas, and K6s!--of how N distributed nodes store incoming files in such a way that the goals of Eternity can be satisfied... (And we need to discuss in more detail just what the goals can realistically, and economically, be.) There are a bunch of issues which come up, motivated by Ryan's comments that he already has the design of a file system in mind: - why won't all machines in the network in Country A simply be shut down, regardless of whether the Authorities can prove which machine in particular is storing the banned material? After all, when a kiddie porn ring has its computers seized, the Authorities don't necessarily have to prove exactly which disk sector (or even which disk drive) is storing a file...they can either seize the lot, and prosecute successfully, that the ensemble was the nexus, or instrumentality of the crime. To paraphrase Sun, "the network _is_ the crime." - given the problems remailer networks have to deal with, with traffic analysis and correlation analysis (an area we have alluded to but not done serious work on), why would not the same methods be applicable to tracking movements through the system Ryan is apparently proposing? (I believe a 20 MB child porn video MPEG sent into the Eternity network would leave "footprints" an analyst or watcher could track. I am willing to be show the error of my ways, but only with some calculations of diffusion entropy, for example.) - In short, I want to see some simple descriptions of WHAT IS GOING ON. It has always been very easy for us to describe how networks of remailers work--so simple that at the very first Cypherpunks meeting in '92 we played the "crypto anarchy game" with envelope-based remailers, message pools, digital cash, escrow, etc. (Running this simulation took several hours, but taught us a lot.) I'd like to know how Eternity DDS _works_. Then we can start mounting attacks on it: spoofing attacks, denial of service attacks, and attacks assuming various levels of observability into the network linking the nodes. Until then, I think it's a waste of time and money to be coding a detailed implementation of a protocol. (And it may _still_ be a waste of money, even after the protocol is beat upon thoroughly. There is no clear market for such a service, and not even for remailers. And maybe not even for PGP, in terms of paying customers sufficient to pay the bills. Not to criticize PGP, just noting the obvious, the same obvious situation that seems to be the case with digital cash. Great idea, but where are the customers?) Thanks, The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

hAt 12:49 AM 1/12/98 EST, Ryan Lackey wrote:

[Tim May wrote:]

...

I am surprised, I have to admit, that Ryan is talking so much about raising money, getting investors, etc., when no _working model_ of his scheme has been deployed for people to play with, find weaknesses in, etc.

No working model has been deployed by me as of yet. However, most of the components are "solved problems", with existing working models. Worst case, it would be possible to accomplish equivalent functionality by linking these by remailers and hoping no one shuts down the remailers.

My guess is that the technical aspects are relatively solvable, at least if the market comes through with reasonable digicash. The technical design can be fun, and lots of pieces exist. The "Don't Quit Your Day Job" (or in this case, school) criteria are harder - doing the business plan that makes a reasonable case that 1 - Service Providers using your model can make money 2 - You personally can make money 3 - Potential investors (including you) can make money funding the development Three obvious business models for you and your investors are 2a - Operate the service yourself, hiring people or renting space in as many countries as you need for safety/reliability 2b - Sell/license the software to commercial providers 2c - Freeware, perhaps with some way for you to get advertising revenue or at least sufficient fame to get consulting business. Which combinations of these options can achieve wide usage depends a lot on your models of users of the system; some of those models are moneymakers, some aren't, some are safe, some are dangerous, and some just attract a sleazy clientele. Here are a few models - public, permanant, non-controversial - the archive business for URLs for academic papers, news services, and possibly for contracts, wills, court documents, etc., which may have some privacy (e.g. an encrypted document showing the owners and keyids) or may not be indexed. This model is easy, and the only reason you need to franchise the business rather than running it yourself is to increase the confidence of the users that the service will be permanent. The obvious financial model is that computers and storage become cheaper every year, so the cost of 100 years of storage is probably only 25-100% higher than 5 years of storage. The costs of retrieval are different from the costs of storage; you may do something like advertising banners to handle frequent-retrieval vs. occasional-retrieval material, or charge directly per hit, etc. - public, permanent, controversial - political manifestos, samizdata, Singaporean chewing-gum recipes, formerly secret documents of governments and businesses. Spreading across multiple jurisdictions is critical here, but governments do cooperate enough that few places are safe for everything. For instance, a Finnish court might order a server to stop publishing copyrighted Scientology documents based on a US court order; anything copyrighted needs to be hosted by non-Berne-convention locations. I don't know how cooperative governments are about libel suits from other jurisdictions; "libel against governments" is clearly a different case from regular personal libel. - non-indexed semi-public medium-term controversial - porn servers, warez, credit reporting services, and the like. By "non-indexed semi-public", I mean things that you can retrieve if you know the name and maybe have a password, but can't retrieve if you don't, and maybe they're encrypted. Some of them may be revenue generators for the storage customer (e.g. they've got advertising banners, or they require digicash to be collected somehow, or maybe there's a password-of-the-month needed to decrypt them, which is sold separately from distribution.) Here you need to worry about attacks, since pictures that are legal in LA or Paris may be illegal in Memphis, Tokyo, or Riyadh, and transaction data that's legal in Anguilla may violate data privacy laws in Berlin or fair credit reporting in Washington, and warez that are gray-market in Beijing may get you jailed in Redmond (while the porn that's legal in Redmond may get you jailed in Beijing.) You also have to worry about targeted attacks - the government that can't stop you from publishing the Anti-Great-Satan Manifesto can go plant child porn and stolen Microsoft warez on your server to get you shut down in your home country. - non-indexed semi-public medium-term non-controversial - encrypted corporate backups and the like. If you've implemented things right, a subpoena for all your files worldwide still won't let anybody find a useful piece of non-indexed data, but can still let anybody with the name and password recover it. Indexing becomes the job of the user; the index for a user is just another data file. This may be where you make the legitimate money, if you can convince enough businesses to use your services, and where you provide the cover traffic for the controversial material. Thanks! Bill Bill Stewart, bill.stewart@pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

Tim May wrote:

I would have thought that a much more robust (against the attacks above) system would involve:

- nodes scattered amongst many countries, a la remailers

- no known publicized nexus (less bait for lawyers, prosecutors, etc.)

- changeable nodes, again, a la remailers

- smaller and cheaper nodes, rather than expensive workstation-class nodes

- CD-ROMS made of Eternity files and then sold or distributed widely

- purely cyberspatial locations, with no know nexus

(I point to my own "BlackNet" experiment as one approach.)

It may be that the architectures/strategies being considered by Ryan Lackey, Adam Back, and others are robust against the attacks described above.

...

Comments?

There is one thing that comes to mind that was just a topic covered on this list and that is the use of cellular/wireless/RF/ham for connections to said machines. Obviously, this would make seizure more difficult (and perhaps increase the likelyhood of prior warning, if for example, cellular service was suddenly cut off). I am currently studying some parallels between the established FCC tolerance of ham radio self-regulation vis-a-vis anonymous remailers. I haven't yet drawn up my opinions, as they are still being formed. I think that this might be one avenue to look down as there is obviously a type of legal precident in what is allowed/tolerated under obvious FCC jursidiction, whereas the jurisdiction over IP is obviously still ambiguous. --David Miller middle rival devil rim lad Windows '95 -- a dirty, two-bit operating system.

Tim May wrote:

At 3:06 PM -0800 1/11/98, Adam Back wrote:

News spool services are already showing signs of getting into this "Usenet censorship" business in a bigger way. Some news spool services honor cancellations (and some don't). Some don't carry the "sensitive" newsgroups. And so on. Nothing in their setup really exempts them from child porn prosecutions--no more so than a bookstore or video store is exempted, as the various busts of bookstores and whatnot show, including the "Tin Drum" video rental case in Oklahoma City.

There is no market-based reason for a general-purpose news server to store a file once it is known it is illegal or even offensive and someone puts any serious amount of pressure on them. You end up needing to steganographically protect your data in the usenet stream, yet then you have to resort to security through obscurity, which royally sucks if you have published source :) You could use some kind of cryptographically steganographically protected data, such that you need a secret key to know stegoed data exists, but then knowing which files to extract becomes a pain -- your server needs to try to extract on *everything*. True, this also solves part of the TA problem (while making the other parts far worse) :) But it really hammers the servers, and makes it unlikely they'll continue to let you access them. You could then foil this by using a bunch of tentacles to pull in data, but this increases complexity and security vulnerability.

...

The solution I am using is to keep reposting articles via remailers. Have agents which you pay to repost. This presents the illusion of

This of course doesn't scale at all well. It is semi-OK for a tiny, sparse set of reposted items, but fails utterly for larger database sets. (If and when Adam's reposted volumes begin to get significant, he will be viewed as a spammer. :-) )

Yes. This (and the URN issue) was one of the initial reasons why I doubted the functionality of his Eternity implementation if it ever became popular. One of MIT's news admins was actually vehemently opposed to this "abuse of usenet", and implied he would go out of his way to not carry such articles. E-DDS should scale well because everyone involved is trying to make a profit.

...

...

- CD-ROMS made of Eternity files and then sold or distributed widely

This is an interesting suggestion, but surely would open the distributor up for liability, especially if copyright software were amongst the documents. Were you thinking of

The CD-ROM distribution is just a side aspect, to get some set of data widely dispersed. For example, if the data base is of "abortion" or "euthanasia" information (a la Hemlock Society), which various parties want suppressed, then handing out freebie CD-ROMs is one step.

Many examples of this: Samizdats in Russia, crypto/PGP diskettes handed out at conferences (was Ray Arachelian doing this several years ago?), and various religious and social tracts. Obviously, this is what broadsheets and fliers are designed to do. Self-publishing in general.

If the intent is to collect money for the data base accesses, then of course other considerations come into play.

(Critical to these "Eternity" things is a good model of the customers, the reasons for the data, etc.)

My implementation allows flexibility -- someone pays for every scarce resource, yes, but it does not have to always be the same person. There will hopefully evolve to be people willing to speculate in data, storing it for free in exchange for a cut, others willing to pay the cost of putting their own data up and making access free up to a certain point, etc. I like CD-ROM distribution. My discman carried munitions, as well as music, recently, on the same disc.

(* I say "working" in the sense that the concept was very easy to demonstrate just by using PGP and remailers. Not much more than what I demonstrated in 1993 would be needed to deploy a real system. Except for one thing: true digital cash. Not the bullshit one-way-traceable stuff that Chaum and others are now pushing, but the original, online-cleared or escrow-cleared form, a la the work of Goldberg et. al. For some of these applications, below, simple token- or coupon-based schemes might work adequately.)

There are currently-under-development systems which will meet the digital cash requirement, from people who I consider highly respectable and competent. Yes, blacknet is a perfect model of a distributed high-latency system. However, to get a system which will actually be useful to end users requires quite a bit more than just storing data -- services like reporting on the reliability of data, allowing easy access to data by third parties, etc. are all pretty essential. Cypherpunks may find blacknet highly useful, but most end users want something that works like the web, or like a database, which is the primary advantage of the current "Eternity" systems.

How these models will work using existing infrastructure (Usenet, remailers, Web proxies, etc.) depends on some factors. It might be useful to consider some benchmark applications, such as:

1. Anonymous purchase of financially important data. (A good example being the Arbitron ratings for radio markets...subscription to Arbitron is quite expensive, and posting of results on Usenet is prosecuted by Arbitron. A good example of a BlackNet market.)

2. Anonymous purchase of long articles, e.g., encycopedia results...

(I'm not sure there's still a market for this....)

3. Anonymous purchase of "term papers." (A thriving market for ghostwritten articles...already migrating to the Web, but lacking adequate anonymizing methods.)

This is an example of a very large data base (all term papers on file) which cannot possibly by distributed feasibly by Usenet.

And so on...lots of various examples.

The whole Eternity thing is interesting, but we haven't made a lot of progress, it seems to me. (I distributed a proposal a bit similar to what Ross Anderson was proposing, a proposal more oriented toward making a _persistent_ Web URL for academics and lawyers to reliably cite, with less of the "404--File Not Found" sorts of messages, the things which make the Web largely unusable for academic and scientific citations.)

Yes, having a persistent URN is highly useful. Adam's implementation kind of solves this, and I have not yet come up with a solution to it -- it would be easy to do a pretty simple persistent URL, but having something which would allow indexing to be something other than a web-search-engine style kludge is more difficult. I've been reading some papers on the topic.

...

...

It is also likely in the extreme that a working Eternity service will quickly be hit with attackers of various sorts who want to test the limits of the service, or who want such services shut down.

I agree with this prediction. Remailers have seen this pattern, with `baiting' of operators, and apparently people posting controversial materials and reporting the materials to the SPA or others themselves, etc.

Yep, it's hard to disagree with this. Any centralized "Eternity service" will be hit with various kinds of attacks in quick order.

Building a data base, as Ryan comments seem to indicate he is mostly interested in doing, is the least of the concerns.

I think perhaps this is inaccurate. I am interested in being able to subsume the functionality of a database for some applications, but I'm trying to build something more like a distributed active agents system. A database implies a single central design -- this would be more a medium in which people could place databases, agents, etc.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

-- Ryan Lackey rdl@mit.edu http://mit.edu/rdl/

Lucky Green <shamrock@cypherpunks.to> wrote:

And the demand for such ecash systems is real. I personally carried a $10 million offer for a non-exclusive license for the blind signature patent to David Chaum. He declined the offer. "The patent is not for license". DigiCash's CEO since March of last year, Mike Nash, also told me that DigiCash was not considering licensing the patent. I knew that day that it was time to quit. Not surprisingly, nobody heard from DigiCash since.

You could challenge the patent, and probably win, for less than $10 million. There is quite a bit of prior art that Chaum neglected to disclose, especially a certain incident where Chaum, as editor of Crypto '84 proceedings, tried to supress part of ElGamal's paper which discussed 'signature conversion' (aka blind signatures).

At 6:46 PM -0800 1/12/98, Adam Back wrote:

One tactic which could protect a USENET newsgroup operator from child porn prosecutions is if he had no practical way to recognize such materials until after it was distributed to down stream sites.

Who are these "USENET newsgroup operators," anyway? (A few newsgroups are moderated, by individuals or committees, but the vast majority are not.) Newsgroups get removed from university and corporate newsfeeds, or by nations, and Adam's ruse would not stop them from continuing to do so.

...

...

The solution I am using is to keep reposting articles via remailers. Have agents which you pay to repost. This presents the illusion of

This of course doesn't scale at all well. It is semi-OK for a tiny, sparse set of reposted items, but fails utterly for larger database sets. (If and when Adam's reposted volumes begin to get significant, he will be viewed as a spammer. :-) )

The best criticism of my eternity design to date! I agree.

I assume you are serious, and do agree, as it is a very solid criticism of the "Eternity as continuous posting to Usenet" model. I see several axes to the analysis of the various Eternity schemes. -- retrieval time for a customer or client to obtain some set of data, ranging from (I assume) ~minutes or less in an Eternity DDS file system to ~days or less in a Blacknet system to (I am guessing) ~weeks or months in an Adam Back sort of system. (Given constraints on Usenet in existence today. Technological and political constraints in how many gigabytes will be sent. The binaries groups are already overloading many systems, of course.) -- bandwidth consumed in the system -- number of nodes -- security (I have my own biases, and will elaborate when I get some time to put my thoughts together.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

Adam Back <aba@dcs.ex.ac.uk> wrote:

Unfortunately good quality textual steganography encodings are I think a hard problem for reasonable data rates. One advantage in our favour is the massively noisy and incoherent garbage which forms the majority of USENET traffic. Plausibly mimicing an alt.2600 or warez d00d message, or a `cascade' seems like an easier target.

yA, d00d, i g0tz yEr stEg0 dAtA eNcOded r1gh+ h3re... ;-)

At 3:35 PM -0800 1/11/98, David Miller wrote:

There is one thing that comes to mind that was just a topic covered on this list and that is the use of cellular/wireless/RF/ham for connections to said machines.

Obviously, this would make seizure more difficult (and perhaps increase the likelyhood of prior warning, if for example, cellular service was suddenly cut off).

In terms of "work factor," such connections are nearly worthless. They might be a bit harder to trap or trace than typical connections, but they are only "security through obscurity" compared to the effort to break a typical cipher. (Put another way, would you feel safe hosting a child porn site just because some of the links were over ham radio or the like? I wouldn't. I'd be waiting for the FCC vans to triangulate....or for the cellphone companies to "cooperate," as they so often have.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

-----BEGIN PGP SIGNED MESSAGE-----

I haven't been following the latest round of "Eternity" discussions. I gather that Ryan's efforts are distinct from Adam Back's efforts, which are themselves distinct from the seminal Ross Anderson researches (for example, at http://www.cl.cam.ac.uk/users/rja14/eternity/node4.html).

Yes, all three efforts are distinct at present. My "secret" plan is to try to get a technical design document and demo which are so compelling that in the end it merges into one Eternity project, though :)

But Ryan's comments leave me with some questions:

At 3:11 AM -0800 1/11/98, Ryan Lackey wrote:

...

If I find investors/customers/etc. by March-July 98 for Eternity DDS, though, I'm planning to buy 8 DEC AlphaPC motherboards with dual 21264 processors. Some pieces of Eternity DDS are now being implemented in Oracle for speed of implementation reasons, and other pieces are being prototyped in Scheme (maybe), so even my K6 is getting hammered. Plus, I'm now testing

Will these be located in the U.S.? Will their locations be publicized? Will any offshore (non-U.S.) locations be publicized?

Hopefully I can allay your fears. I want the alphas for testing and compiling during the not-yet-production phase. They'll be located in one place, subject to being shut down legally or extralegally. However, there will be no production data on them, so there will be no reason to shut them down. To attack them preemptively would be less efficient than simply killing the maybe 20 people in the world who are involved with Eternity development. I want to have a cluster of machines on which to simulate a working eternity system. I'm trying to develop interconnect protocols which scale to a large number of users with the minimum possible trust, no particularly vulnerable points, etc. Even me personally owning any substantial amount of machines involved in a production Eternity implementation while living in the US would be risky -- I want people to be able to continue to use Eternity even if I turn out to be a secret NSA agent bent on world domination.

[vulnerability of any identified servers]

To this I add the threat of illegal action by enemies of users of the system, government or otherwise. As a result, having *any* of the nodes be locatable on a network or in physical space is a threat. Knowing the IP addresses of all the Eternity servers in the world would be enough to let you flood them out of existence. Unfortunately, in order for Eternity to be accessible to the world in some way, some nodes need to have public logical addresses in some way. This opens up a bunch of pathways to attack. Eternity DDS has market-based protocols to try to hinder these attacks.

So, the talk about the hardware of all these Alpha servers raises some interesting questions.

I would have thought that a much more robust (against the attacks above) system would involve:

- nodes scattered amongst many countries, a la remailers

- no known publicized nexus (less bait for lawyers, prosecutors, etc.)

- changeable nodes, again, a la remailers

- smaller and cheaper nodes, rather than expensive workstation-class nodes

- CD-ROMS made of Eternity files and then sold or distributed widely

- purely cyberspatial locations, with no know nexus

(I point to my own "BlackNet" experiment as one approach.)

Yes, that's effectively what I'm trying to do. Eternity DDS is currently being developed on the "Athena model" as a bunch of interoperating services with general utility as well. During testing, I'm using stuff like Oracle to prototype large sections of the application. I've run hundreds of clients off my K6 talking to a couple of servers on my K6. This does not mean that the production system will involve my k6 in any way, except perhaps as my client. I think that Eternity is effectively a massive distributed database, in that a filesystem is a kind of database. I also think selling just storage is kind of silly -- one needs to take into account bandwidth and computation as well, in order to allow people to do truly interesting things. With a sufficiently trusted JVM, one could execute some subset of java code remotely fairly securely. I'm planning to have interfaces to the Eternityspace which make it look like a massive web server, a massive traditional database server, a filesystem, ftp, email server, etc. This helps functionality and security. The design is a compromise between security and efficiency. In many cases being distributed is good for both, but in at least two areas, trying to make E-DDS distributed is making it less efficient. I forsee that the initial limited production system will have a nexus in that the auction market will probably be run by my organization through a geographically-dispersed network of machines with byzantine fault tolerance. I also forsee an initial small number of nodes interfacing Eternity DDS to the world (via the web, database protocols, filesystem protocols, etc.). While there will be encryption between those servers and their clients, they will be targets for attack -- however, there are a bunch of techniques for making them ephermeal, some of which you have mentioned.

It may be that the architectures/strategies being considered by Ryan Lackey, Adam Back, and others are robust against the attacks described above.

I hope so.

Basically, if the Eternity service(s) can be traced back to Ryan or Adam or anyone else, they WILL be subject to court orders telling them to produce certain files, telling them to cease and desist with regard to certain distributions, and so on. Even raids to carry off the entire file system for analysis will be likely.

I hope to leave the country before Eternity DDS goes public. I think raids on US sites, or unprotected foreign sites, are highly likely, legal or otherwise. I don't believe any government will provide any real defense for an identified Eternity server or nexus or involved person, once it starts being used for corporate espionage, money laundering, political activism, etc. The only defense is to make sure the collateral damage from taking it out is high enough that they won't, like an inoperable tumor (a 10mm does a good job of removing most individual cancer, but sometimes killing the patient is unacceptable) Hopefully, the designers of the first production Eternity service can make themselves irrelevant enough to not be worth killing, and/or difficult enough to kill that the collateral damage from killing them would be unacceptable.

It is also likely in the extreme that a working Eternity service will quickly be hit with attackers of various sorts who want to test the limits of the service, or who want such services shut down. Thus, expect all kinds of extremely controversial material to be posted....granted, this is a "reason" for such services, but see how long the system lasts when it contains child porn, Scientology secrets, lists of CIA agents in Europe, copies of Microsoft Office for download, and on and on.

Yes. I'm designing for the worst.

And even a decentralized, replicated system will of course still expose the owner/operator in some jurisdiction to his local laws. (As Julf was exposed to the laws in his country, and that was just the tip of the iceberg.

I'm planning to move to the most laissez-faire location possible. I also want to make myself irrelevant once the system enters production (which does not necessarily mean I won't try to get rich, just that if someone corrupts or kills me it won't make any difference to the operation of the system).

Eternity nodes must not be identifiable, and their locations must not be known. Anything else is just asking for major trouble.

I agree with you 100%. There are technical considerations which come into play defending eternity nodes from TA, other corrupt nodes, etc., but they are in the main solvable. The borders of the eternity logical network become exposed, but it is possible to push those borders far enough out that it becomes the responsibilty of other unwitting parties to shut them down. My design goal is truly distributed and truly secure. In order to take out eternity, I hope to make it necessary for the attackers to take out the Internet, something even overly communist regimes are unwilling to do. I think Adam Back's Eternity implementation mostly meets the "lightweight nodes which no one cares about" in theory, and if his assumption that usenet will not be attacked is valid, it has met the "unacceptably high collateral damage" criteria. I'm somewhat unsure of that assumption, though. Plus, the central difference between Eternity DDS and the other two Eternity designs is that market forces will be used to give people an incentive to break the law by running Eternity DDS servers secretly in Burma (both internal storage nodes and throwaway interface nodes). I think market forces are the only way to get people to implement a large enough Eternity logical network to provide protection from a concerted attack.

Comments?

More discussion would be great. I think everyone agrees on the basic requirements for Eternity implementation -- it's just a question of which compromises one must make to technical expediency, as well as advanced technical methods one can use to minimize those compromises. [Pseudo-ob-non-crypto: I apologize for sof.mit.edu's web server being dead for a while. It managed to wedge itself quite nicely, and I didn't find out about it until someone sent me mail. Again, I'm putting as much documentation as I can up on http://sof.mit.edu/eternity/] - -- Ryan Lackey rdl@mit.edu http://mit.edu/rdl/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNLmM16wefxtEUY69AQGobAf/c8PleA2nc4a17HikOGbevX6l/hJzZCf1 ZwwSM2X9jT0Jbg3FhGBt4aj2mRSDDYA9C96StMl2tNZlIQf4PKtyIt2mysh4dO1L OsmAgemdqh9oHSEHalSDasGURSdzWBCuMctgcwT2BA+zWmWNILo4pw8ePgH2Hc2e tTmJpfrALMU2pOjkeQ3R6OPOVRPc4JRz/XpRLcFbwEy2DahVzc1ICjfdO7II/qhd 3UJtpxF+mKBrSLVfCINrkg6kXR2c9aL4bFBm5ZoINADH/sPSqghzgNRE9RLLpvqD 2bZmmzUUAgoTNhSEqHk0xl4VaRmVBf1JntetTmWBe1h2b7rh/Anr5w== =0O/n -----END PGP SIGNATURE-----