- cypherpunks-legacy@lists.ogf.org

Junk email/encrypted return-path-blocks
by zane＠genesis.mcs.com 02 Jul '93

02 Jul '93

I've been recently working at the direct-mail place putting rubber bands around mass mailings of junk mail (ah, the wonders of being a poor soon-to-be college student), which got me thinking about electronic junk mail and how such a thing can be avoided. In rl, you can go to the store, buy a product with cash, and you're not put on their mailing list. Buying via mail order, using check/credit-card, etc., requires that they get your address so they can put you on their mailing list, compile statistics about who you are, etc., as we all know. Now, over the net, suppose I wanted to buy an email product. I'd pay for it with digital cash, communicating with the vendor through the anonymous remailers. Now I see a problem in how the vendor will deliver the product. Obviously I can give the vendor my email address encrypted with the remailer's public keys, so the vendor still doesn't know who I am. But the vendor can still keep a database of address-blocks and which address blocks go with which purchases. Then the vendor can compile her mailing list of address blocks, and even *sell* this list to others, with product purchase history. Even though the junk-mailers don't know who I am, they can still flood my box with email. I thought of two possible solutions. The first solution I thought of requires a great deal of bandwidth. The vendor could simply post publicly (to usenet or something) the product I wanted, encrypted with my public key. (Rather, a public key I created just for this venture with a psuedonym so that none could see that it was I who was buying from the vendor.) The bandwidth for this thing would be incredible. The second solution I thought of seems like it would work. When I create the return-address block, it can be given some sort of ID-code (again, like with my other idea posted, similar to the ID-code on peices of Digicash in Chaum's scheme) so when the vendor delivers the product, she sends to encrypted block to the remailer, and the remailer forwards the product to me, and stores the ID-code in its database (doing the proper one-way transformation for untraceability) so that further attempts to use the exact same address-block will be noticed and not delivered. I also thought of creating a digicash like entity, a currency to pay for remailer transactions, so that sending junk mail through a remailer would be prohibitively expensive. It will probably happen anyway once we near the goal of full crypto-anarchy that most remailers will not operate without a fee, while the scheme I present above seems like it would work with both free remailers and those which charge for usage. (And a charge on a remailer which agrees with the market probably won't be high enough to stop a really rich junk mailer from spending the cash on junk mailings.) -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | "Symbiosis is Good" - Me_"Specialization is for Insects" - R. A. Heinlein_/ \_______________________/ \______________________________________________/

1 0

CLIPPER IN SCIENCE NEWS
by Sandy 02 Jul '93

02 Jul '93

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, I have missed some messages because of a computer problem. Perhaps someone has already mentioned or reprinted an article by Ivars Peterson ("Encryption Controversy -- A Fierce Debate Erupts over Cryptography and privacy") about the Clipper, Capstone, et al. in June 19 issue of SCIENCE NEWS. If not, I would be willing to transcribe the article into ASCII and upload it to the list if enough folks are interested. S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Boston cpunx mtg Jul 10?
by fnerd＠smds.com 01 Jul '93

01 Jul '93

A good time for the Next Boston area Cypherpunks meeting would be the second saturday of July--july 10, at 6 PM EDT. At least that would be good for me, and easy to remember since it's the canonical time... -fnerd quote me

5 4

Clipper article (and an OCR check)
by Dan Veeneman 01 Jul '93

01 Jul '93

Cypherpunks, This may be old news to most of you, but I just got my HP ScanJet IIc working with Caere's OmniPage Pro 2.1, and thought I'd scan this in to give it a try. Note to D.C. Cypherpunks (or anyone else, for that matter): I'll be happy to scan any documents or newsclippings you send my way. I'm located in Columbia, Maryland. I'm reachable by UUCP e-mail at uunet!anagld!ftgcorp!dan. >From Network World, issue date May 31, 1993. OPINIONS SECURITY PERSPECTIVES BY MICHEL KABAY Vigilance is needed to keep Clipper Chip in check Last month, the federal government endorsed a new encryption technology based on the Clipper Chip. The Clipper Chip will give federal agencies a key to unlock users' encrypted voice and data communications. Network users can live with this situation, but only if they're vigilant about preventing any attempt to make the Clipper Chip the only legal encryption mechanism available in the U.S. The Clipper Chip will serve some legitimate needs. As the U.S. builds its National Information Infrastructure, increasing amounts of data will flow electronically throughout the nation. Users will need encryption to protect their sensitive data. In a multivendor world, having a common encryption standard, such as the Clipper Chip, will simplify protection so users won't even notice their communications being encrypted. However, users have many questions and concerns about the Clipper Chip, as well. Internet users are curious about how the chip was developed: specifically, what companies and individuals were consulted and how the initial manufacturer, Mykotronx, Inc. of Torrance, Calif., was selected. This information might cast light on the quality of the chip and the price to be charged. Internet users also wonder why the algorithm is being kept secret. Without free access to the algorithm, many argue, the scientific community will not be sure that the algorithm actually functions as claimed. Defenders of the plan point to a proposed examination by selected experts, but any closed process leaves open the question of whether there is a back door to decryption. A major user concern involves key escrow, which is at the heart of the administration's proposal. Government agencies would hold pairs of incomplete decryption keys for every Clipper Chip installed in the U.S. To decrypt private communications, a government agency would need to get a warrant to obtain the two parts of the decryption key. INSET: Clipper Chip will give federal agencies a key to users' encrypted communications Anyone who discovers the key pairs for a specific Clipper Chip could decode all encrypted communications initiated by that device, even after the warrant expires. Therefore, the trustworthiness of the key escrow agencies is crucial to avoid abuses of the decryption keys. The partial keys might be stored in databases or generated by black-box decryption devices. Any party involved in creating these databases or devices would be a vulnerable point in the control over decryption. It would be valuable to know whether the federal government has studied the risks and estimated the costs of providing adequate protection. If so, many users would want to evaluate such studies independently. Key escrow for foreign purchasers of the Clipper Chip and for foreign manufacturers will also cause problems. If other countries use the technology and have all the keys in escrow, U.S. users may find their own security compromised by legal systems beyond their control. But the biggest concern regarding this technology is that it could lead to a ban on all unauthorized encryption technology in the U.S. A few years from now, anyone using a non-Clipper Chip encryption method could be assumed to be engaging in crime. Political pressure to ban all non-Clipper Chip encryption could become intense. Making non-Clipper Chip encryption illegal would lead to enforcement problems. Applying the technology only to voice transmissions would raise the popularity of data transmission -- that is, digitally encoded voice file transfers. So it would have to be applied to data, too. But failure to produce clear text using the Clipper Chip decryption could be construed as evidence of illegal encryption, even if the original data stream was not, in fact, interpretable. The prospect of astronomers being arrested because law enforcement officials couldn't make sense of their data on elemental composition of supernovas is pretty funny--if you like that kind of joke. I urge all users to fight any attempt to make the Clipper Chip the only legal encryption mechanism in the U.S. For further developments in the ongoing debate, users should follow the dialogues on the Internet in the Risks forum, the Privacy forum and the new alt.privacy.clipper news group. END Kabay is director of education with the National Computer Security Association in Carlisle, Pa. He can be reached at (717) 258-1816 or on the Internet at 75300.3232(a)compuserve.com. -- dan(a)ftgcorp.UUCP (Dan Veeneman) Fountainhead Title Group

1 0

ANON: free speech
by Karl Barrus 01 Jul '93

01 Jul '93

Wow, Here's an unfortunate case of somebody who could have used anonymous methods to protect his speech and speak without fear: Gregory Steshenko was fired from Microsoft because users on a elist he was on complained. Check out the USENET post (I saw it in alt.comp.acad-freedom.talk) but it was crossposted to zillions of groups. /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

2 1

REMAIL: Error reporting implemented
by miron＠extropia.wimsey.com 01 Jul '93

01 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- I've implemented error reporting on remail@extropia. The errors are forwarded to errors(a)extropia.wimsey.com. This is an anon pool (=mailing list). Errors are concise, explaining what went wrong. The incoming Subject: line is used as the (sole) identifier. To subscribe to the error list, send 'subscribe' on the subject line to errors-request(a)extropia.wimsey.com. For help, send 'help'. - -- Miron Cuperman <miron(a)extropia.wimsey.com> | NeXTmail/Mime ok Unix/C++/DSP, consulting/contracting | Public key avail AMIX: MCuperman | Laissez faire, laissez passer. Le monde va de lui meme. -----BEGIN PGP SIGNATURE----- Version: 2.2x iQCVAgUBLDMe6pNxvvA36ONDAQHgzwP+J3ra5Z/c8WpNgMlnlfnyAbvLbi8SHgsD HkWHzWr1et+3CP8mt+F/esDIQLmJZuHp+ulZsMowunVdNvfQQy/UU1jeMsepijkJ 2fqIJTjddAgdxs6cIPeZbEHjwFUbfGers5swH7aVe/NM2/W+38zGn3XzdOKHJMly 9llSzJ9K+CA= =V+9b -----END PGP SIGNATURE-----

1 0

REMAIL: list of remailers 7/1/93
by nobody＠eli-remailer 01 Jul '93

01 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: 1: nowhere(a)bsu-cs.bsu.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)pmantis.berkeley.edu 4: hh(a)soda.berkeley.edu 5: 00x(a)uclink.berkeley.edu 6: hal(a)alumni.caltech.edu 7: ebrandt(a)jarthur.claremont.edu 8: phantom(a)mead.u.washington.edu 9: remailer(a)rebma.mn.org 10: elee7h5(a)rosebud.ee.uh.edu 11: hfinney(a)shell.portal.com 12: remail(a)tamsun.tamu.edu 13: remail(a)tamaix.tamu.edu 14: remailer(a)utter.dis.org 15: remail(a)extropia.wimsey.com NOTES: #1-#5 no encryption of remailing requests #6-#14 support encrypted remailing requests #15 special - header and message must be encrypted together #9,#14,#15 introduce larger than average delay (not direct connect) #9,#14,#15 running on privately owned machines ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks directory at soda.berkeley.edu (128.32.149.19). Instructions on how to use the remailers are in the remailer directory, along with some unix scripts and dos batch files. The public keys for the remailers which support encrypted remailing requests is also available in the same directory. Mail to me (elee9sf(a)menudo.uh.edu) for further help and/or questions. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLDLfl4OA7OpLWtYzAQHb8wQApHOt2pmOHoRJn7VZqUtZh3b+DLcSDI3i ReClJ//VYO2p30e5ZGlP6zhdfB0N6lbR3nK1d1u6a8hfIKM67Y9KorAgYRrIZr/n 7z/yj8mhX4FG606naDVIy0eXbwX/R5+XiYA00WQNRfhfzYdSxBibmpbdX7mFH/V+ xlkiNkCs+0E= =urKR -----END PGP SIGNATURE-----

1 0

REMAIL: list 7/1/93
by nobody＠mead.u.washington.edu 01 Jul '93

01 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: 1: nowhere(a)bsu-cs.bsu.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)pmantis.berkeley.edu 4: hh(a)soda.berkeley.edu 5: 00x(a)uclink.berkeley.edu 6: hal(a)alumni.caltech.edu 7: ebrandt(a)jarthur.claremont.edu 8: phantom(a)mead.u.washington.edu 9: remailer(a)rebma.mn.org 10: elee7h5(a)rosebud.ee.uh.edu 11: hfinney(a)shell.portal.com 12: remail(a)tamsun.tamu.edu 13: remail(a)tamaix.tamu.edu 14: remailer(a)utter.dis.org 15: remail(a)extropia.wimsey.com NOTES: #1-#5 no encryption of remailing requests #6-#14 support encrypted remailing requests #15 special - header and message must be encrypted together #9,#14,#15 introduce larger than average delay (not direct connect) #9,#14,#15 running on privately owned machines ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks directory at soda.berkeley.edu (128.32.149.19). Instructions on how to use the remailers are in the remailer directory, along with some unix scripts and dos batch files. The public keys for the remailers which support encrypted remailing requests is also available in the same directory. Mail to me (elee9sf(a)menudo.uh.edu) for further help and/or questions. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLDLfl4OA7OpLWtYzAQHb8wQApHOt2pmOHoRJn7VZqUtZh3b+DLcSDI3i ReClJ//VYO2p30e5ZGlP6zhdfB0N6lbR3nK1d1u6a8hfIKM67Y9KorAgYRrIZr/n 7z/yj8mhX4FG606naDVIy0eXbwX/R5+XiYA00WQNRfhfzYdSxBibmpbdX7mFH/V+ xlkiNkCs+0E= =urKR -----END PGP SIGNATURE-----

1 0

No Subject
by Anonymous 01 Jul '93

01 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Just a few updates: Eric Hollander told me he is working on updating the uclink remailer to only remail encrypted messages (like extropia) so that explains why it seems to be down... for now I moved it to the other remailers which don't support encrypted requests, and alphabetized the list by host. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLDLkCIOA7OpLWtYzAQFU+gQApPtko5koIevDJmBNo7YPkD3h6ZOybFW8 d7pzJaY6aYAN3DQUS9EHxzMiMrqNllwERvxV1+Ztr9Fgig1Ur7t/OL76WxJryV35 m+F6fOYdq5VP9j37AUr6LUXV4rg4SKcIVCip85eY6UBCLuwcio38wUSAbMbm8fP7 glUzWuSlmtI= =G7/a -----END PGP SIGNATURE-----

1 0

Re: LEB corruption in Clipper phones--the backdoor?
by karn＠qualcomm.com 01 Jul '93

01 Jul '93

Why are we pointing out these flaws publicly? You should let them pass, so that the flawed Clipper chips get widely deployed. THEN you go in front of Malarkey's subcommittee and demonstrate to the whole world how to intercept any Clipper-encrypted conversation without the escrowed keys. Then just stand back and watch the fun begin. 1/2 :-) Phil

1 0