- cypherpunks-legacy@lists.ogf.org

"Clipper" in Norway (FYI)
by HELGE RENE URHOLM 20 Aug '93

20 Aug '93

The Department of Defence in Norway have given permission to develop a new crypto-chip to use in all public and confidential data, which has been collected about persons and groups. The algorithm is secret. The chip has been compared with the American Clipper-project. The Department of Defense will be administering the keys, and the user will have no choice whether they want to use the chip or not. They are even trying to enforced the health system to use this chip. Last week Hans Olav Oestgaard (head of the Norwegian secret service) said he wanted a law which enforce companies and single persons to encrypt all information such that the secret service can access the information in a simple way.

1 0

Violent Revolution?
by nobody＠alumni.cco.caltech.edu 20 Aug '93

20 Aug '93

++> From: koontzd(a)lrcs.loral.com (David Koontz ) + >Cypherpunks are providing the basis for long-range, (relatively) secure + >communication between those activists and thinkers who may have the + >power to bring down the State and restore the individual autonomy this + >nation was originally devised to foster. ++> As I understand it the Libertarian Party qualifies membership to ++> exclude any endorsement of violent overthrow of government. 1] I didn't see that the writer said anything about Libertarians. 2] I didn't get the impression that the writer was specifically calling for the violent overthrow of the government, only that he/she believed that actual violence _might_ eventually come. ++> While some ++> portion of those affected by this policy may well have gone ++> underground... Of course, I cannot personally say with any accuracy, but I feel strongly that a private ("underground," if you prefer) network of those discussing radical options must exist as a direct result of more secure communication. I have no evidence of this, but it seems like such an obvious and irresistable consequence that I can't picture it NOT happening, especially considering the numbers of pissed-off people using computer networks these days. ++> I don't believe that cypherpunks as a committee of the ++> whole are willing or ready to do so. 1] I didn't get the impression that the writer was saying that Cypherpunks were part of any such conspiracy, if it even exists, but only that Cypherpunks tech aided their communications. 2] I have also never been clear on how formal an organization Cypherpunks actually are - if they actually have a platform or a membership roster or secret handshakes or have turned the word "Cypherpunks" into a registered trademark with marketing licensed for logoed adjustable size baseball caps and childrens' lunchbox sets. Is there sufficient officialness for the result of a nut with "CYPHERPUNKS!" on his chest in Magic Marker biting off Hillary Roddam's left thumb at a press conference to be the forfeiture of Tim May's personal fortune under RICO? I wonder. ++> Then again as someone pointed out yesterday, cypherpunks aren't just ++> libertarians... Whatever gave you the idea that they were? ++> Some ++> portion, however large of those receiving this mailing list, may not ++> agree with this political leaning and may not consider it germaine to ++> their participation. Certainly true enough, but who claims to "speak" for cypherpunks anyway? ++> Avoiding the appearance of endorsing the violent overthrow of ++> government is prudent policy for any organization. Hell, yes. If I were signing my name to stuff, I'd be as benightedly pro-Statist in my posts as David Sternlight himself.

1 0

Re: Physical to digital cash, and back again
by hfinney＠shell.portal.com 20 Aug '93

20 Aug '93

I agree with Anonymous that there are problems with the actual use of digital cash in the near term. But it depends to some extent on what problem you are trying to solve. One concern I have is that the move to electronic payments will decrease personal privacy by making it easier to log and record transactions. Dossiers could be built up which would track the spending patterns of each of us. Already, when I order something over the phone or electronically using my Visa card, a record is kept of exactly how much I spent and where I spent it. As time goes on, more transactions may be done in this way, and the net result could be a great loss of privacy. Paying in cash is still possible through the mail, but it is insecure and inconvenient. I think that the convenience of credit and debit cards will overcome most people's privacy concerns and that we will find ourselves in a situation where great volumes of information exist about people's private lives. This is a place that I could see digital cash playing a role. Imagine a Visa-like system in which I am not anonymous to the bank. In this model, imagine that the bank is granting me credit similar to a credit card. But instead of giving me just an account number which I read over the phone or send in an email message, it gives me the right to request digital cash on demand. I keep some digital cash around and spend it for transactions as I described in my previous posts. When I get low I send some email to the bank and get some more dcash. Every month I send a check to the bank to cover my account just as I do with my credit cards. My relations with the bank are very similar to my current relationships with the credit card companies: frequent withdrawals and a single payment each month by check. This has several advantages over the system which we are heading towards. No records are kept of where I spend my money. All the bank knows is how much I have withdrawn each month; I may or may not have spent it at that time. For some transactions (e.g. software) I could be anonymous to the vendor; for others the vendor might know my real address, but still no central location is able to track everything I buy. (There is also a security advantage over the ridiculous current system in which knowing a 16 digit number and an expiration date allows anyone to order anything in my name!) Furthermore, I don't see why this system could not be as legal as current credit cards. All that really differs in this system is the inability to track where users spend their money, and as far as I know this ability was never an important legal aspect of credit cards. Certainly nobody will admit today that the government has a vested interest in moving towards an environment in which every financial transaction is tracked. Granted, this does not provide full anonymity. It is still possible to see roughly how much each person spends (although nothing stops a person from withdrawing much more cash than he will spend in a given month, except per- haps for interest expenses; but maybe he can lend the extra digicash itself and gain interest on that to compensate). And it is oriented around the same customer/vendor model that Anonymous criticized. But I maintain that this model represents the majority of electronic transactions, today and in the near future. It's worth noting that it is not trivial to become a merchant who can accept credit cards. I went through this with a business I had a couple of years ago. We were selling software through mail order, and this makes the credit card companies very nervous. There is so much phone fraud in which credit card numbers are accumulated over a few months, then large amounts of charges made against them. By the time the user receives his monthly statement and complains, the vendor has disappeared. In order to get our credit card terminal we went to a company which "helps" startups with this. They seemed like a pretty shady outfit, themselves. We had to fudge our application to say that we'd be selling something like 50% of the units at trade shows, which apparently counted as over-the-counter sales. And we had to pay about $3,000 up front, as a bribe, it seemed. Even then we probably couldn't have done it if we hadn't had an office in the business district. Under the digital cash system, this might be less of a problem. The main problem with digital cash is double-spending, and if you are willing to go with online verification (reasonable for any business which is going to take anything over several hours to deliver the merchandise) this can be completely prevented. So there is no longer any possibility of merchants collecting credit card numbers for later fraud. (You still have problems with non-delivery of merchandise, though, so not all risks are eliminated.) This might eventually make the system more widely available than current credit cards. I don't know whether this system could be used to support illegal actions, tax evasion, gambling, or whatever. That is not the purpose of this proposal. It does offer the prospect of improving personal privacy and security, in a framework that might even be legal, and that's not bad. Hal Finney hfinney(a)shell.portal.com

1 0

Encrypted cypherpunks list
by hfinney＠shell.portal.com 20 Aug '93

20 Aug '93

A reminder to old subscribers, and a notice to new: I have some software running on this system (related to the remailer software) which can be configured to send a PGP-encrypted version of the list to subscribers. This way you can receive this "subversive" material without any local system operators knowing what you are doing. Send me your address and PGP public key if you'd like to be put on the encrypted list. Hal Finney hfinney(a)shell.portal.com

1 0

parallel DES thread
by nfe＠scf.nmsu.edu 20 Aug '93

20 Aug '93

nobody@alumni... please write me. nfe(a)freedom.nmsu.edu

1 0

Re: mailing list <-> newsgroup ?
by mbriceno＠aol.com 20 Aug '93

20 Aug '93

gtoal(a)gtoal.com writes: >Admittedly, if [Cypherpunks] comes in with your real mail it would be a pain. It does come with my regular mail and yes: it is a pain. >But I'd rather keep it as email than news just to keep that cretin >Sternlight out :-) I stopped reading the PGP news group. This Sternlight guy is monopolizing-and thereby destroying- the discussion. Better stay a mailing list. --Marc

1 0

Fiat currency: Re: Electracy: Evil Revisited
by wcs＠anchor.ho.att.com 19 Aug '93

19 Aug '93

(Most of this is diatribe, and I wasn't sure whether to Cc: cypherpunks, but there's some relevance to creating digital currency near the end.) Paul Moses writes: > Sorry, but today's currency system is anything but a democracy. Thank God. > It works because it is entrusted to a COMPETENT elite. Gack, sputter, foo, bletch! The currency system works so *badly* because it's trusted to an elite who can abuse it for their own power and enrichment. It works as well as it does because currency *is* a market, so it's subject to the usual price (all the market will bear) and power is subject to the usual limits (overabuse leads to revolution), and the elite is competent enough to know how much it can get away with. Yes, an incompetent elite is usually worse (e.g. the old Argentina or Israel), and democratically controlled fiat currency is inherently incompetent (the Golgafrinchians in HHGTTG declaring leaves to be money, etc., and their current US version, the Populist Party.) But fiat currency, anywhere, any time, can always be abused, and eventually is. Hard currency, such as gold, or silver, is subject to market fluctuations, but there's some inherent value, and a fair amount of local stability. Consumable commodity currencies, such as tobacco, alcohol, cows, and grain, have their obvious drawbacks, but they're very useful in pre-industrial societies (including the US up to the mid-1800s), and use reappears in badly trashed economies (immediate post-WWII Germany, when the alternative was fiat scrip deutschmarks, which were rapidly being printed and inflating.) In all of the non-fiat systems, the value of the "currency" is variable, but *you* decide what value *you* place on it, relative to the market. In fiat systems, *somebody else* (maybe "everyone", maybe an oligarchy) decides not only what value they place on it, but what value YOU must place on it. It's backed, not by trust, but by theft and threat of violence or default; witness the US confiscations of gold and legal tender laws, or the current Russian replacement of old rubles with limited quantities of new ones. Non-fiat soft currencies, including Green Stamps, private banknotes, etc. work ok because the issuers realize they are subject to the constraints of the market, so they have to maintain the goodwill of their customers, either through backing with harder currencies, goods or services, or through expectations of future backing with them. That's easiest to maintain if you're a provider of services, or if you're (for example) providing a convenient storage/exchange of other currencies. In addition to US and other government fiat currency, I also use a variety of private currencies - checks and credit cards, which are agreements to provide quantities of real silver money, (or substitute Federal Reserve private banknotes instead); New York Subway Tokens and New Jersey freeway toll tokens, which are agreements to provide services; Joe's Coffee Pot money, which is an agreement to provide addictive drugs :-). I know and trust Joe, and he'll either provide the coffee out of the accumulated coffee profits, or his own pocket, and I'd only be out a buck if he defaults anyway. I somewhat know and distrust the New York and New Jersey transportation bureaucracies, but they'd take too much political heat if they defaulted, and the price for their services never decreases :-), so I'm willing to risk 1-20 bucks, and tokens are a bit cheaper than cash in NJ. I use credit cards mainly for convenience; merchants are willing to give me stuff in return for my signature on a credit card bill because they trust the credit card provider to generally pay up. Merchants in the US generally accept US traveller's checks, because they can get cash for them cheaply and quickly; merchants in Central or Eastern Europe either didn't take them, or gave me less than face value for them. If we're going to start using digicash, and want people to accept it in return for goods and services, we either need to back it with services (like email or remailing or software support or freeway tolls), or we need to back it with other-currency transport/delivery/storage services the way credit cards and travellers checks do, or find some other reason for people to want the digicash and trust its value-stability. > [Elitist stuff about mob rule under democracy, deleted] I agree with most of what you say there. I'd be happy to have a system where the public could BLOCK new legislation, or get rid of old legislation, but just not make new stuff; the catch is how to implement it in a way that doesn't get the positives and negatives mixed up. Bill Stewart

1 0

Re: Traveller's Checks...
by Peter Wayner 19 Aug '93

19 Aug '93

Many banks make money on float. Could digital cash pay interest? I guess the bank could append a date to the cash and mark up the value when it is "spent", but that might compromise some of the anonymity. I'm sure the bank would volunteer to guard our anonymity in the strictest sense by not paying the interest. -Peter

1 0

new tran
by cme＠ellisun.sw.stratus.com 19 Aug '93

19 Aug '93

I've just modified tran to operate off the histogram of inputs and have posted the code to sci.crypt. It's also available from me by e-mail. - Carl

1 0

Cypherpunk DES distributed DES last post
by nobody＠alumni.cco.caltech.edu 19 Aug '93

19 Aug '93

Since the list keeper has requested, let us let the DES parallel breaking die, for the time being at least. I mentioned a possible Cypherpunk project to set up a network of parallel DES de-cryptors linked by cryptographically secure anonymous remailers to avoid obvious detection (although one could argue all those flops in the night might speak for themselves). A quick test shows the Sparcstation IIPX doing about 100 decryptions per second in a typical unloaded system from a user account (these are relatively small decryptions...we assume here we are decrypting a text which only a small portion needs to be decrypted to reveal its appropriate entropy measure). Or over eight unused hours at night, in the neighborhood of 3 million decryptions. Let's even assume we can marshall 5000 similar machines through our combined talents, that's 15*10^9 decryptions. Keeping in mind the total 56-bit keyspace is 72*10^15, we're still talking around 5 million nights to solve the problem (~13,000 years). If we want to solve one system per month, it looks like we can only handle about 38 bits worth of keyspace. Not very impressive. So, until the next technological leap, we can probably forget about this.

1 0