November 1992 - cypherpunks-legacy@lists.ogf.org

chip verification ( Was: Tollhouse Cookies :-)
by Richard Childers 26 Nov '92

26 Nov '92

"The crucial chips could be built under "open inspection" conditions, much like having source code for inspection prior to compilation on one's own--presumably trustworthy--machines. Several such vendors could be used, with independent auditors observing the processing steps throughout. (Merely the threat of a surprise inspection is probably enough to head off obvious attempts to insert hardware trapdoors and the like.) This seems like a solvable problem." It seems to me that an ostensibly digital device with a fixed number of pins could be regarded as a finite state system, and systematically analyzed accordingly, IE, traverse the set of possible combinations of pins and signal levels and verify that it behaves in accord with pub- -lically available specifications. I'm no circuit designer ( yet ), but it seems to me that the microchip might be subject to design to make it conform to such tests, yet still contain additional circuitry which is undocumented. It might also have analog circuitry, I suppose, although I cannot immediately conceive of a use for such a thing. ( Of course, nanotech rears its ugly head, but that sword cuts both ways and, until it manifests, is irrelevant. ) Perhaps a chip could be tested, at the cost of additional time, by a systematic profiling of the finite boundaries of the device as repre- -sented by the combination of pins being stimulated, the combination of pin input voltage levels, and the resulting pin output voltages. If you want to be fanatical, you can also profile the resulting fields. It seems to me that it would be difficult to defy such a systematic profiling. ( I guess one could also test the I:E:R ratios at each of the states to further detect bogus circuitry, as well as borderline products. ) Why quality assurance lines don't do this on a chip-by-chip level now is beyond me. I'll bet the Japanese do now, or are working on it ... -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration Klein flask for rent. Inquire within.

2 1

Subscription
by jdugger＠reed.edu 26 Nov '92

26 Nov '92

Sorry about the bandwidth waste, but please subscribe me. ------------------------ Jay Dugger jdugger(a)reed.edu ------------------------ PGP Public Key available

1 0

No Subject
by nobody＠alumni.cco.caltech.edu 26 Nov '92

26 Nov '92

This entire business may be pretty simple. If we have anonymity both ways, (where one or neither party knows the others physical location), then who cares about the content of the message? You might as well send it in plain text, Except you need RSA just for the signitures so you know you aren't being spoofed. *RSA signatures ARE money.* Unless money (accouting, proof) is needed, you don't need RSA. What you do need is anonymity. {Of course throwing RSA on top of it with RSA encoded regular keys is a nice touch (no sense in giving anything away.)} ---- Now listen up kiddies, what you are playing with is sedition, conspiricy, and the like. In other words plain old politics. Adding mumbo-jumbo (crypto) technology doesn't change a thing. If you want to do this, it is a simple matter of building a large enough cooperative group. How big? Well bigger than the Hells Angels, Maybe a thousand people. I don't know. Depends on how rough it gets. But the proceedure is just mutual backscratching. We all accept and forward anonymous mail for each other. So long as it is coded, we can deny knowledge of the contents. That can go a long way as long as the basic activity (of forwarding) itself is not proscribed. There have been several suggestions here how this would be done. You send mail to a cooperative site, who forwards it. That same site will receive replies. You collect your mail with specific commands to dump the accumulated contents to some other node. It would be moderately tough to bug one node. A quick second skip would make it almost impossible to track, 3 quick skips to eternity. But the trick is to have a large net of standardized, cooperating sites. There have been suggestions to throw cypher-money into this equation to pay for the operation of the "MIXes" or the operators of the servicing nodes. But that won't work. In a hostile environment money won't buy civil disobedience. It's like you can't pay somebody else to go to war for you. We all have to shoulder part of the risk. We should evolve some standard "remailer/replier daemon" and run them as a common service. It is just our civic duty. The list of cooperating, volunteer sites would be published in a plain text group. You are either on the list or you aren't. Just the presence of such a cypher mob should stop the forces of darkness. -Gilbert

2 1

Cypherpunks List (fwd)
by tcmay＠netcom.com 26 Nov '92

26 Nov '92

Cypherpunks, Happy Thanksgiving! I sent the following message to the "Extropians" list, a list centered around discussions of politics, technology, the future, "uploading," transhumanism, and the like. (As with our list, they can be subscribed to with the "-request" form. Several requests for more information about our list prompted me to write this summary piece. Inasmuch as our existence has been publicized in Mondo, on alt.hackers, and in various references in messages, I felt it appropriate to tell them a few things about what the list is about. Our address is at the very end of the article, so there's a minor obstacle for truly casual readers to overcome. I'm forwarding it to you folks because we've had a lot of new subscribers ourselves, and they may like to hear some of this stuff. I apologize to those who are getting this twice. -Tim May Forwarded message: To: Extropians(a)gnu.ai.mit.edu From: tcmay(a)netcom.com (Timothy C. May) Subject: Cypherpunks List Date: Thu, 26 Nov 92 10:51:01 PST The Cypherpunks List -- A Thanksgiving Message I guess it's time to say a few words about the "Cypherpunks" list, which I've referred to several times in the last few months. Eric Hughes, the list administrator and initial organizer of our first meeting, has also mentioned the group in several places, and the latest "Mondo 2000" actually gives the address, so the information's pretty much out by now. We've avoided the "cattle call" form of invitation, where public announcements are made and subscribers flood in. But we also haven't gone to the other extreme of requiring some puzzle to be solved (as with posting to "alt.hackers," which usually requires some hacking of the posting software to "get in.") Cracking a cypher is not a requirement, though some probably think it should be. A few points: * The name "Cypherpunks" started out as a pun by Jude Milhon, an editor at "Mondo 2000," when she said "You guys are just a bunch of cypherpunks!" We initially debated calling our informal group something more staid like "The Cryptography Research Society," partly to protect ourselves by emphasizing the "research" aspects, but the joke name stuck. So, like it or not, it's "Cypherpunks." It turns off some, turns on others. C'est la vie. * Note that we have very little to do with the Gibsonesque vision of punked-out outlaws and virtual reality escapades, though in fact some of our members are active in Bay Area start-up companies doing VR. I would say Vernor Vinge's "True Names" is more descriptive of what we're doing. * About a hundred or so folks are on the list, including some journalists (gulp!), and even some "*.mil" sites (!!). But since what we're doing is strictly "research," we are of course safe. * The focus is on cryptology, anonymous remailers, hardware support, PGP, digital cash, "dining cryptographers" nets, and so on. Too much to recapitulate here. * By focussing on "research" into these areas, we feel we are safe against attack by government agencies. Time will tell. These issues of security, privacy, remailers, digital pseudonyms, etc., are hot topics in the crypto community, and all we are really doing is applying these ideas and doing experiments, the better to learn. (Some of the work on "webs" of trust in PGP systems, on issues with anonymous remailers, and on the development of "digital reputations" lies in uncharted territory, that is, we're doing true research.) * Several Extropians are active on the list, as you may have gathered from cross-posts and comments. * Because many of the early members live in the Bay Area (Northern California, Silicon Valley), we've had three physical meetings so far. John Gilmore, a founder of Cygnus Support, has graciously offered his facilities for our meetings, which typically happen on Saturday afternoons. The schedule gets posted on the list, of course. * Some exciting progress has already been made. Eric Hughes and Hal Finney have implemented a PERL-scripted remailer which provides anonymous forwarding (though the security is only "manual"), and 2-way remailers with digital pseudonyms seem imminent. Integrating PGP into mailers remains a problem, as those of you who use PGP already know, and several of our members are working with the PGP and MacPGP teams. * "Crypto dongles" to attach to RS-232 ports are being pursued by Yanek Martinson (an Extropian as well), George Gleason, John Draper ("Cap'n Crunch"), and others. Lots of enthusiastic debate. * FIDONet users are also involved, including Tom Jennings, the founder of FIDONet, in 1984. This brings an exciting new flavor for most Internetters. * Like the Extropians list, the Cypherpunks list is relatively free from flames and personal attacks. We all realize we're interested in roughly the same goal, even though some are Libertarians (naturally) while others are Socialist, Marxists, and Act Up! activists. (Interestingly, we've never had any real flames on politics. We almost never argue political views. This may of course be alien to readers of the Extropians list! :-} ) * So why isn't the list sent out in encrypted form? A little thought will reveal the uselessness of encrypting a widely distributed list that's essentially open to anyone who sends in a request! Still, there is some talk of encrypting in the future, partly to weed out the casual readers (for whatever reason) and partly to just get the volume of encrypted messages up. If you've read this far, and are really interested in joining the list, send a request to "cypherpunks-request(a)toad.com". This is standard list procedure, of course. But please don't then complain about the list volume! --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: by arrangement.

1 0

Re: Electronic Banking
by richard_mezirka＠askinc.ask.com 26 Nov '92

26 Nov '92

IRS regulations related to 1099-b and 1099-misc make it LEGAL providing all parties and the BANK file with the IRS. Bank MUST file when over 100 transactions per year are recirded. Individuals must file each transaction. Add some rules for mandatrory electronic filing when movre than 500 (I think that's the limit) transactions are posted. ZAdd another hassle with mandatory 20% of value must be withheld and filed with IRS inlieu of taxes... (reference 1992 IRS publication on 1099 processing, pages 10-12... pub number available on request)(I left my copy at the office). As I told Tim, this smack s of Al Capone like harassment... "We''' make it WORSE if we catch you" BUT I have personal experience with IRS in 1980, 81, 82 as they attacked barter (I designed and developed software for an electronic settlement system for Trade Systems Corporation in San Jose; we did about 4 million/year unitl the IRS audits startedf and then all big players got tax attacked). for those without experience with our IRS, remember they do not live within our regulary judiciary (innocent until proven guilty) system with open courts... they seize first and have a closed hearing system underwhich you get to negotiate a settlement to get YOUR stuff back, maybe. (references available upon request). They use local marshalls with large guns and IRS judical orededers to tsake what everthey thiink they are due. Again, as I told Tim, we should continue our public discussion of the principles we hold dear and continue our efforts at preventing further erosion. We should also be very careful about stepping on the dragons' tails until we are privacy protected... principlesa nd theorey public, practice and tactics private. spreading the sanity, quietly Rich

1 0

Re: Electronic Banking
by tony＠morgan.demon.co.uk 26 Nov '92

26 Nov '92

In message <9211252219.AA00550(a)netcom.netcom.com> you write: > > Warning! Recently, a bunch of bowlers (women, no less) were busted for > illegal gambling because of their "pot" they were bowling for. After > much public outcry and laughter at the authorities, the charges were > either dropped or reduced. I mention this because casual bowlers evoke > sympathy, hackers and cypherpunks do not. Using the net, the 'banker' could easily be 'offshore' and not subject to US law in these matters. After all the internet reaches into Canada and obviously (from my point of view) to the UK. I think a more real problem with anonymous banking, is not one of 'trust' in the 'banker' but in his net access. What do you do when your banker, for whatever reason, becomes unreachable? Regards Tony ------------------+-------------------------------+--------------------------+ | Tony Kidson |`morgan' is an 8MB 486/33 Cat-| Voice +44 81 466 5127 | | Morgan Towers, |Warmer with a 670 MB Hard Disk.| E-Mail | | Morgan Road, |It resides at Morgan Towers in| tony(a)morgan.demon.co.uk | | Bromley, |Beautiful Down Town Bromley. | tny(a)cix.compulink.co.uk | | England BR1 3QE | -=<*>=- | 100024.301(a)compuserve.com| +=================+===============================+==========================+

2 1

Re: RS232 Crypto Dongle (idea for widely accessible crypto technology)
by George A. Gleason 26 Nov '92

26 Nov '92

Re Phil's items on the Crypto-Dongle. I'm in favor of a device having a keypad for PIN entry, with a fail --> destroy function. Making it small enough to be kept on one's person all the time, virtually guarantees other manufacturing compromises which would result in degraded reliability or increased potential for physical breakage. It should not be necessary to carry it on you; in any case, possession of one might raise eyebrows in some quarters. I believe that carrying out the entire crypto operation in the dongle is preferable to having it only do the secret key RSA processing; if for no other reason, compatibility problems that might result in creation of platform-specific dongles. Better to have one Universal Dongle that needs only a platform-specific user interface. The dongle (suggested brand name: Codepack) could also be sold as a sort of blank slate into which a user would load his preferred crypto software. Now we have a generic product which can be sold over the counter without prescription, as it were. -gg

1 0

Re: PGP on local machine (was Re: MacPGP)
by George A. Gleason 26 Nov '92

26 Nov '92

Eli discussed some ideas regarding online encryption... it suddenly occurred to me that if you were connected to the phone line while doing your crypto processing, it's entirely possible that some signal would leak through and if your phone line was being monitored, the nastie-wasties would get the whole thing including your private key. Uh-oh, very bad. Thus the need for some kind of hardware device which isolates the line and all that. Perhaps a specifically cryptographic modem as has been proposed by others here. And perhaps a tweak in the software which requires that the user set these options manually at some point, where a warning message would occur to say, "don't do on-line crypto unless you have (one of the protected modems)." -gg

1 0

Re: How far is to far?
by George A. Gleason 26 Nov '92

26 Nov '92

Miron Cuperman responds to my concerns about the IRS's claims on barter systems by saying, "How do you think the IRS is going to trace those banks and customers behind all the anon mixes?" I must really disagree here. If we start sneaking around in the shadows of legality, we will eventually bring down some nasty attention which will not help us. Privacy itself is a mainstream issue. Dumping all forms of taxes is not a mainstream issue, in fact the mainstream regards tax resisters as fringies of the worst order. This is not to debate the merits of the substantive issues involved, just to recognise the major PR problem which exists and say I believe we should stick to the main issue. I for one don't want the Feds to have an excuse to lock up the whole net or our little fragments of it. We can minimise taxation and stay completely within the law by operating as a volunteer not-for-profit network. And then if the Feds come down on us for using unregistered crypto keys, we have a new issue that the public haven't become jaded over, which can be made much of in the media. And I would also say that it's not good to give potential adversaries an excuse for saying we're doing crypto simply in order to hide illegal activities such as "tax cheating" or whatever; next it will be dope and kiddie porn and bank robbery via ISDN, eh...? -gg

1 0

Failed Fail Report
by Postmaster 26 Nov '92

26 Nov '92

The enclosed fail report failed to reach it's intended recipient because of the use of the unbracketed IP number. HOWEVER, surely there should be a -request address for cypherpunks to which should be in the Sender: field so that fail reports go back to the list maintainer and not the originator of the article. Tim Brooks Postmaster((a)uk.ac.cam.ucs, @uk.ac.cam.phx, @uk.ac.cam.cus, @uk.ac.cam.ppsw) Postmaster((a)ucs.cam.ac.uk, @phx.cam.ac.uk, @cus.cam.ac.uk, @ppsw.cam.ac.uk) University of Cambridge Computing Service Tel: 0223-334709, Int: +44 223 334709 New Museums Site Fax: 0223-334678, Int: +44 223 334678 Pembroke Street Telex: 81240 CAMSPL G CAMBRIDGE E-Mail(JNT): T.Brooks(a)UK.AC.Cam.UCS CB2 3QG United Kingdom "(Internet): T.Brooks(a)UCS.Cam.AC.UK X.400: /I=T/S=Brooks/OU=Computing-Service/O=Cambridge/PRMD=UK.AC/ADMD= /C=GB/ > Accepted: 17:57:03 25 Nov 92 > Submitted: 17:29:12 25 Nov 92 > IPMessageId: <"ppsw1.cam..157:25.10.92.17.28.53"@ppsw.cam.ac.uk> > From: MAIL-DAEMON <postmaster(a)uk.ac.cam.ppsw> > To: FAILREPTER(a)uk.ac.cam.phx > Subject: Delivery Report (failure) for fnerd(a)192.9.200.3 > Received: from ppsw.cam.ac.uk by ppsw1.cam.ac.uk id <05165-0(a)ppsw1.cam.ac.uk>; > Wed, 25 Nov 1992 17:29:12 +0000 > Message-Type: Delivery Report > Content-Identifier: Fail Report > > ------------------------------ Start of body part 1 > > This report relates to your message: Subject: Fail Report, > Message-ID: <A6A5DE7C97F29040(a)UK.AC.CAMBRIDGE.PHOENIX>, > To: fnerd(a)192.9.200.3 > of Wed, 25 Nov 1992 17:28:52 +0000 > > Your message was not delivered to fnerd(a)192.9.200.3 > for the following reason: > Unknown Address > Unknown domain '192.9.200.3' > > ***** The following information is directed towards the local administrator > ***** and is not intended for the end user > * > * DR generated by: mta ppsw1.cam.ac.uk > * in /PRMD=UK.AC/ADMD= /C=GB/ > * at Wed, 25 Nov 1992 17:28:53 +0000 > * > * Converted to RFC 822 at uk.ac.cam.ppsw1 > * at Wed, 25 Nov 1992 17:29:12 +0000 > * > * Delivery Report Contents: > * > * Subject-Submission-Identifier: [/PRMD=UK.AC/ADMD= /C=GB/;<A6A5DE7C97F29040(a)UK.AC.CAMBRIDG] > * Content-Identifier: Fail Report > * Subject-Intermediate-Trace-Information: /PRMD=UK.AC/ADMD= /C=GB/arrival Wed, 25 Nov 1992 17:28:52 +0000 action Relayed > * Subject-Intermediate-Trace-Information: /PRMD=UK.AC/ADMD= /C=GB/arrival Wed, 25 Nov 1992 17:28:40 +0000 action Relayed > * Content-Correlator: Subject: Fail Report, > * Message-ID: <A6A5DE7C97F29040(a)UK.AC.CAMBRIDGE.PHOENIX>, > * To: fnerd(a)192.9.200.3* Recipient-Info: fnerd(a)192.9.200.3, > * /RFC-822=fnerd(a)192.9.200.3/OU=PP Switch/O=Cambridge University/PRMD=UK.AC/ADMD= /C=GB/; > * FAILURE reason Unable-To-Transfer (1); > * diagnostic Unrecognised-ORName (0); > * last trace (ia5 text (2)) Wed, 25 Nov 1992 17:28:40 +0000; > * converted eits ia5 text (2); > * supplementary info "Unknown domain '192.9.200.3'"; > ****** End of administration information > > ------------------------------ Start of forwarded message 1 > > Received: from phx.cam.ac.uk by ppsw1.cam.ac.uk > with NIFTP (PP-6.0) Cambridge as ppsw.cam.ac.uk > id <05157-0(a)ppsw1.cam.ac.uk>; Wed, 25 Nov 1992 17:28:53 +0000 > Date: Wed, 25 Nov 92 17:28:40 GMT > To: fnerd(a)192.9.200.3 > From: Mail Server <FAILREPTER(a)uk.ac.cam.phx> > Subject: Fail Report > Message-ID: <A6A5DE7C97F29040(a)UK.AC.CAMBRIDGE.PHOENIX> > > Your message was not delivered to one or more of: > LI10000(a)uk.ac.cam.phx > > Recipient has too many outstanding messages in message store: 'LI10000(a)UK.AC.CAM.PHX' > No valid recipients in JNT header > > Failed message follows: > > Received: from relay2.UU.NET by ppsw1.cam.ac.uk > with SMTP (PP-6.0) International as ppsw.cam.ac.uk > id <05143-0(a)ppsw1.cam.ac.uk>; Wed, 25 Nov 1992 17:28:32 +0000 > Received: from toad.com by relay2.UU.NET > with SMTP (5.61/UUNET-internet-primary) id AA07054; > Wed, 25 Nov 92 12:20:09 -0500 > Received: from cygnus.com by toad.com id AA12348; Wed, 25 Nov 92 09:17:33 PST > Received: from relay2.UU.NET by cygnus.com (4.1/SMI-4.1) id AA26873; > Wed, 25 Nov 92 09:17:10 PST > Received: from uunet.uu.net (via LOCALHOST.UU.NET) by relay2.UU.NET > with SMTP (5.61/UUNET-internet-primary) id AA05539; > Wed, 25 Nov 92 12:15:15 -0500 > Received: from smds.UUCP by uunet.uu.net with UUCP/RMAIL (queueing-rmail) > id 121431.10955; Wed, 25 Nov 1992 12:14:31 EST > Received: from waldo by smds.com (4.1/SMI-4.1) id AB05506; > Wed, 25 Nov 92 11:29:04 EST > Message-Id: <9211251629.AB05506(a)smds.com> > Sender: fnerd(a)192.9.200.3 > Date: Wed, 25 Nov 1992 12:40:24 -0800 > To: cypherpunks(a)com.toad > From: fnerd(a)com.smds (FutureNerd Steve Witham) > Subject: Re: Random Numbers Boxes and Cypher Processers > > >Why do encryption in the modem instead of the host cpu? > > A point that hasn't been made painfully clear yet: "DSP--Digital > Signal Processor" chips are really just fast processors for repetitious > arithmetic--just what RSA needs. Maybe some experience in > programming them for that sort of purpose would be useful. > > - -fnerd > fnerd(a)smds.com (FutureNerd Steve Witham) > > > ------------------------------ End of forwarded message 1

1 0