- cypherpunks-legacy@lists.ogf.org

FAQ in sci.crypt
by tcmay＠netcom.com 02 Dec '92

02 Dec '92

Cypherpunks of Cypherspace, I just found a new FAQ and bibliography in sci.crypt. It's by Larry Loen and is intended as a stopgap FAQ, as sci.crypt hasn't had a good FAQ in a while. It doesn't cover the digital cash, anonymous remailers, crypto anarchy, etc. kinds of stuff, but it answers FAQs about one-time pads, ciphers, RSA, etc. Since this is a mailing list, I will not forward it. (It's 26 or so screenfuls of VT-100 screens, which is fairly long.) Also, I still have the "Crypto Glossary" available for forwarding to any newcomers to this list. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: by arrangement.

1 0

.
by nobody＠rosebud.ee.uh.edu 02 Dec '92

02 Dec '92

Subject: Digital Cash One point of digital cash is to allow electronic payments, so printing it on paper would not be useful as other than a novelty. People would have to scan the bit patterns back in, which would be inconvenient. How big will a piece of digital cash be? An electronic "dollar bill" in the simple scheme of Chaum's consists of two parts: (x, f(x)^(1/e). X is a random number, f(x) is a one-way function like MD5, and e is the exponent which could be taken to represent the denomination of the bill. MD5 takes 64 bytes as an input "chunk" so that would be a natural size for x. f(x)^(1/e) is f(x) "signed" by the bank using exponent e, so that would be about the size of the bank's modulus n, say 1024 bits or 128 bytes. Probably there would be some control information as well. So the total size of an electronic banknote would be 128 + 64 + a few, or about 200 bytes, maybe a little more. To print this you'd have to Ascii-encode it, which generally expands things by 1/3, so you'd get about 270 to 300 characters per bill/coin. This would be around four or five lines of text, comparable to a PGP key (and looking about as interesting - totally jumbled letters and numbers). "Forgery" is in one sense hard and in one sense easy. It's hard because to create new dollar bills because you have to forge a signature using the bank's public key (n, e). This is equivalent to breaking at least some uses of RSA. But it's easy to reproduce existing electronic dollars, and you don't even need a Xerox machine. Just "copy dollar1 dollar2" on your PC, and repeat the process. Presto, plenty of dollars, all exactly the same. Send one to the butcher, one to the baker, and you've still got plenty more where those came from. Keeping this kind of re-use from occurring is one of the things that makes electronic cash tricky. Chaum's simple scheme has the receiver of cash calling the bank or sending the cash there right away. The bank has a list of "serial numbers" for all the cash that's ever been deposited, which it compares against to see if this is a re-use. The first person to deposit a dollar with a given serial number gets credit for it; the others are told that it's worthless. Another area that people seem a little unclear about is the difference between electronic cash and electronic checking accounts. A checking account could be managed by simple RSA-signed messages (e.g. created with PGP) saying, please transfer $X.00 to account number XYZ. If you wanted to buy something from someone, you'd find out what his account number is with the bank, write up a little note like this, sign it using your public key with PGP, and email it to the person that you wanted to buy from. He'd send it on to the bank and his account would get credited. Again, you'd want to put a serial number on your check so that the guy couldn't send it again tomorrow and get another $X.00. Or, you could just send it directly to the bank and request the bank to notify the seller that the funds had been transferred. This would seem to avoid the re-use problem. The difference between this system and electronic cash is that the bank knows exactly what is going on. It sees all transactions, so it knows which accounts are making payments to which other accounts. This is true of ordinary paper checking accounts as well, of course. Electronic cash is designed so that not even the bank can tell who is paying whom. I withdraw some cash, say, $100.00, and I pay you $35.00 by mailing you the electronic bills. You deposit them. The bank has no way of determining which particular withdrawal produced those bills which you are depositing. This is, more or less, how real cash works. Hal 74076.1041(a)compuserve.com

1 0

summary of remailers
by Karl L. Barrus 02 Dec '92

02 Dec '92

Here is a summary of the currently available anonymous remailers: hal(a)alumni.caltech.edu -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.01 mQBNAisCtU0AAAEB/jNOYzN1B2YzOxlK/Zb6axoOaGlPq5I7DV9GH3hcGRN5N6Fi T4sRLhi53Sc5rUdYDa8mFQd4tqvFG6rHcT8LtDcABRG0KlJlbWFpbGluZyBTZXJ2 aWNlIDxoYWxAYWx1bW5pLmNhbHRlY2guZWR1Pg== =K00H -----END PGP PUBLIC KEY BLOCK----- remailer(a)rebma.mn.org -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQCNAisUI2QAAAEEAKgm07Hsje5KpmXYd5azk0R6AES+qK7LcofnVGojUs7GBghD WbwrmW8oOEOhRorlShRALKeYspV4xYIw4WDkJcJxuf1B254scz1urF/Eem3zPW9b yPAx7W/cGwvs6SouZvFcSDq4v1zApvGE9hP4szPzHeGmVr0NVNeaDK0guoCpAAUR tCBSZW1haWxlciAocmVtYWlsZXJAcmVibWEubW4ub3JnKQ== =/qHx -----END PGP PUBLIC KEY BLOCK----- elee7h5(a)rosebud.ee.uh.edu -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQCNAiscKOYAAAED/jmrZbh5t5HgEHDGE2zzFZx3sIplEjIFRFsLpCfJYBfN36Rm uT8VGIyCcUSmCTqEOJ5HJZF58CUCOsy3B215ptOvbZdGijC3Qs7FbtGHKGA49q0v gBgVIcjjyppRI9YjfqlI2gUKDLPceCTw20ODAA7UTKYIa3IBS32zjcrFq/uzAAUR tCZyZW1haWxlcjAzIDxlbGVlN2g1QHJvc2VidWQuZWUudWguZWR1Pg== =9mBX -----END PGP PUBLIC KEY BLOCK----- /-----------------------------------\ | Karl L. Barrus | | barrus(a)tree.egr.uh.edu (NeXTMail) | | elee9sf(a)menudo.uh.edu | \-----------------------------------/

1 0

anonymous remailer
by Karl L. Barrus 02 Dec '92

02 Dec '92

Fellow cypherpunks: There is a new anonymous remailer for our use. Its address is elee7h5(a)rosebud.ee.uh.edu, its name is "remailer03", and here is the public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQCNAiscKOYAAAED/jmrZbh5t5HgEHDGE2zzFZx3sIplEjIFRFsLpCfJYBfN36Rm uT8VGIyCcUSmCTqEOJ5HJZF58CUCOsy3B215ptOvbZdGijC3Qs7FbtGHKGA49q0v gBgVIcjjyppRI9YjfqlI2gUKDLPceCTw20ODAA7UTKYIa3IBS32zjcrFq/uzAAUR tCZyZW1haWxlcjAzIDxlbGVlN2g1QHJvc2VidWQuZWUudWguZWR1Pg== =9mBX -----END PGP PUBLIC KEY BLOCK----- Also, here is a script I have to use the remailers. It is the ultimate in brute force :-) Perhaps if more people implemented remailers, a general script can be written to bounce mail off them all, or a subset of them all, in the style of Bill's scripts which were recently posted. It didn't take long at all to set up: I spent most the time installing perl in my account, and tracing down an annoying bug that was my fault - I forgot to make the *.pl files executable. -----------8<--------->8---------- if [ $# != 3 ] then echo "Usage: anon.mail message destination remailer" exit 1 fi anon1=remailing mail1=hal(a)alumni.caltech.edu anon2=remailer mail2=remailer(a)rebma.mn.org anon3=remailer03 mail3=elee7h5(a)rosebud.ee.uh.edu message=$1 dest=$2 if [ $3 = remailing -o $3 = hal -o $3 = alumni -o $3 = 1 ] then remail=$anon1 mailaddr=$mail1 fi if [ $3 = remailer -o $3 = rebma -o $3 = 2 ] then remail=$anon2 mailaddr=$mail2 fi if [ $3 = remailer03 -o $3 = elee7h5 -o $3 = rosebud -o $3 = 3 ] then remail=$anon3 mailaddr=$mail3 fi t1=.anon1 t2=.anon2 echo "::" > $t1 echo "Request-Remailing-To: $dest" >> $t1 echo "" >> $t1 pgp -ea $t1 $remail echo "::" > $t2 echo "Encrypted: PGP" >> $t2 echo "" >> $t2 cat $t1.asc >> $t2 cat $message >> $t2 rm -rf $t1 $t1.asc mail $mailaddr < $t2 -----------8<--------->8----------

2 1

whoops! Too much 8086 assembly,
by The Phantom 01 Dec '92

01 Dec '92

Too much assembly language and not enough FPU support. It was pointed out that I should simply try recompiling with the coprocessor option. :l Sure easier than writing it in assembly, eh? ahem. thanks for you time - Matt Thomlinson University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 528-5732 PGP 2.0 key availaible via email or finger phantom(a)hardy.u.washington.edu

1 0

Re: PGP and Digi-money
by Richard Childers 01 Dec '92

01 Dec '92

"Should everyone on the list be given a set amount of digital cash to start the 'poker game', or will we choose a smaller, representative sample? " Maybe we should generate some digicash with a PostScript printer, just to make it interesting. I wonder how public key cryptology would effect efforts to counterfeit ? It seems to me that this same technology could make cash much harder to forge ... even allowing one to actually _print_ one's tender, authenticated by the information buried in the serial number of the bill ... and it would be the serial numbers that the bank would track, not the actual pieces of paper. -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration Klein flask for rent. Inquire within.

1 0

PGP and Digi-money
by The Phantom 01 Dec '92

01 Dec '92

Well, it looks like it is going to happen. I, too, am interested in seeing the experiment run. The way it was talked about earlier this week, I pictured a system where people would snail-mail an amount of money to a central authority (bank) and would be turned into credits. Since this was only a simulation (not to raise eyebrows) I was thinking that a cap could be established (say, $25). Now it looks as if we'll have no acutal cash backing for the first simulation. How will this be distributed? Should everyone on the list be given a set amount of digital cash to start the 'poker game', or will we choose a smaller, representative sample? For the game, we'll have to set up an account as an internet `bank', scripts to handle incoming cash requests, etc. Are these the least of our worries? I'm also willing to help in any way I can, although I too know little C. I have a decent background in various other areas which may be helpful. On an entirely different subject: Has anyone worked up a PGP version that may help me out? My 286 plugs along when working on keys. :) I am specifically wondering if anyone has hacked in and created a PGP that supports the '87 coprocessor. thanks- Matt Thomlinson University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 528-5732 PGP 2.0 key availaible via email or finger phantom(a)hardy.u.washington.edu

1 0

Lazy man's PGP key collection
by fnerd＠smds.com 01 Dec '92

01 Dec '92

I collect PGP keys with a PGP keys mailbox. Instead of trashing a message when I'm through reading it, if it has a PGP key, I transfer it to the PGP keys mailbox. In Eudora that means pulling down the Transfer menu to the "-> PGP keys" entry. These are, of course, only play keys. They could be from people who aren't who they say they are, or they could have been tampered with on the way to me. Unless they've been signed by someone I trust and have a trustworthy key for. (Just a standard disclaimer anytime I mention public keys.) -fnerd only her cryptographer knows for sure fnerd(a)smds.com (FutureNerd Steve Witham)

1 0

Re: How far is to far?
by fnerd＠smds.com 01 Dec '92

01 Dec '92

Mark (mark(a)coombs.anu.edu.au) sed > Maybe it's not in the spirit of this mailing group but Seems on topic to me. > what of the question > of purposeful abuse of the anon mailers/newsposters? Say for instance some > person posts either a sh*tload of garbage to every known group, flooding > the USENET... Tim May and Fen Labalme have given good replies. I hate the sloppy setup of the internet/usenet/netnews/mailing-lists in general. The way things are gives anarchy a bad name, and I think they could use a good hosing off--if only that would mean they would get cleaned. Unfortunately the way people react to abuses is often just to add extra patches. Take "kill files," which Tim mentions. The thing I hate about that term (even more than that they're lists of people to "kill,") is that they're after-the-fact. Here's this mail that keeps pouring into my mailbox, and every day my robot has to find and burn the 90% that even a robot can be taught to recognize as junk. Prompt, temporary STUPID relief of symptoms. (I mean, while I'm at it, I hate the broadcast-and-filter model of netnews, CD ROMs, and cable TV. I want things available for me to go fetch.) That kind of filtering has a place, but I like more positive-reputation, positive-interest models. Like subscription mail groups. Also, I understand that Fido users have to pay their own transport charges. I don't know if that applies to the "echo" groups, but it should...Mr. Jennings?...because that's another natural kind of filtering against network hosing. You can flood my mailbox if you pay me enough. >> or a more personal attack whereby they send out anonymously >> information that was so fundamentally personal to someone they could >> possibly react very badly.... >> >> What if someone posted some top secret information and the various three >> letter acronyms all went out for someone's blood. I guess these won't happen much, just judging from how much they happen now even though they're not that hard to do. But sure, they'll happen. It would be nice if people learned information-hygene lessons like skepticism and protecting privacy, and accepting-life lessons like accepting what does get revealed about oneself and others...(whistful grin). More like, people will learn if we teach; things will change if we change them. Scary issues are good educational material when used right, especially when you can say, "This is stupid and it can be *fixed* and we can use your help." -fnerd quote me...within *reason* of course fnerd(a)smds.com (FutureNerd Steve Witham)

1 0

Nike says: Just Do It
by Karl L. Barrus 01 Dec '92

01 Dec '92

I agree with Mark's letter: we've philosophized enough - let's implement a digital bank. The only thing I have to go on is a recently posted summary of a digital cash scenario - apologizes to the poster, I don't have the article handy and I can't remember who nicely summarized the protocol. If that summary isn't good enough, I'll go look for more of Chaum's stuff. I'm willing to help pull such a feat off - even if to start I (and anybody else who wants to help!) take Email and respond by hand. The only high precision math routines I have are the rsa programs that are available @ghost.unimi.dsi.it (see Dave Vincenzetti's (sp?) recent message on sci.crypt) OR what I used during my crypto class for working through various protocols: Mathematica. Automating the procedure can come later, and I'm willing to work with anybody in doing that as well. If initially the transactions are handled by hand and Mathematica, don't expect a rapid turnaround! :-) The nice thing about Mathematica is that I can run it remotely and don't need to be in front of the NeXT to do it - especially since the command line version is good enough for out purposes: high precision integer math, etc. I remember the protocol involved a hash (MD5 is suggested) of an input to produce a number. Suggestions? Would turning the MD5 output into a hex number be good enough? Anyway, I'm going to work through the protocol a few times by hand and post again with more info in a bit... /-----------------------------------\ | Karl L. Barrus | | barrus(a)tree.egr.uh.edu (NeXTMail) | | elee9sf(a)menudo.uh.edu | \-----------------------------------/

1 0