Digital Cash

Hal writes:

 > The notion of a "cryptographically tamperproof software
 > module" is interesting, but I'm not sure such a thing exists
 > or could exist.  The secure offline cash systems I have seen
 > rely on tamper-resistant HARDWARE modules which at least
 > exist although this requirement would be very inconvenient.

Quite a bit of work has already been done on this concept.
Basically one generates a very large sequence of machine
instructions which computes the image of the output of an
algorithm under a strong cipher from the image of the input under
the cipher.  A controlled amount of redundant information is
added to both the input and output.  This yields a piece of code
so obtuse and complex that nothing may be gleaned about what
algorithm it is executing by observing it run.  Figuring out what
it actually is doing is a cryptanalytically hard problem.  Also,
determining a way of modifying the code which does not break it
is a similarly hard problem.

Once encased in such a module, an algorithm may be distributed
with no fear that it will be stolen.  This raises interesting
poblems with software patents, since one can not tell from such a
module whether it is performing a function in a way which
infringes.

Of course, there is a severe performance penalty to be paid for
such protection.  But in the case of digital cash, it could
provide a mechanism for implementing a secure offline system
without special hardware.

 > Again, I don't know how you handle the case of two
 > almost-simultaneous attempts to redeem the same note (or
 > piece of cash).  Both notes are identical, so having the two
 > notes gives you no more information than having just one,
 > hence if one note is anonymous so will two be.  You know
 > someone is cheating in this situation, but who?  One of the
 > redeemers may have stolen a copy of the cash from the other;
 > the two redeemers may be working together; or the note maker
 > may be working with one of the redeemers having slipped them
 > a copy of the note as soon as it was presented for
 > redemption.  How can a court decide who is right?

Assuming the transactions are done via a tamperproof module
distributed by the issuer, and the math is arranged such that
using a note in multiple transactions reveals the perpetrator,
the system prevents anonymous double-spending while still
providing all the benefits of digital cash.  Of course, you could
claim that someone was in possession of your tamperproof module
and associated passwords, but it is your responsibility to guard
these and report them stolen promptly, just as with credit cards
and PINs.

P.S. Is anyone worried that the Netherlands seems on the verge of
banning PGP?  Wasn't this country once a hacker's paradise?

-- 
     Mike Duvos         $    PGP 2.3a Public Key available    $
     mpd@netcom.com     $    via Finger.                      $

Mike Duvos wrote:

> P.S. Is anyone worried that the Netherlands seems on the verge of
> banning PGP?  Wasn't this country once a hacker's paradise?
> 

This has been apparent for a while now, with numerous reports that
several European countries are far along in adopting Clipper-type
systems. Possibly under cooperative arrangements with the USA.

As for the Netherlands being a hacker's paradise....recall that
telephone and other services are under the control of the "PTT"
(Postal, Telegraph, and Telephone monopoly) that's
so common in European countries. If they say "no modems may be
attached," that's the law. (I don't know the current status, but at
one time there were severe restrictions, heavy fees, etc.)

Ask the guys at Hactic, De Zwarte Star, and BILWET (Amsterdam Association for
the Dissemination of Illegal Science) about the surveillance done on
them by the BVD, the Binnenlandse Veilegheids Dienst, the Dutch
Internal Security Service. 

France essentially bans all crypto--enforcement may be another matter
(ask SDECE).  One of our Norwegian members recently reported on
proposed legislation in his country. Britain is taking steps. And what
is going on in Germany, with the Bundesnachrichtendienst (BND), their
version of the CIA, asking for and receiving broad new surveillance
powes. (And Germany's version of the FBI, the Bundeskriminalamt (BKA),
is getting into the wiretap business in a big way.)

"Orderly societies" like those in Europe prize order and control over
the "cowboy" aspects of America.  Just because the American debate
over Clipper and Digital Telephony is so loud and angry here in the
U.S. is no reason to believe that the same measures are not already
being put into place in Europe and parts of Asia.

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

On Thu, 24 Mar 1994, Timothy C. May wrote:

> As for the Netherlands being a hacker's paradise....recall that
> telephone and other services are under the control of the "PTT"
> (Postal, Telegraph, and Telephone monopoly) that's
> so common in European countries. If they say "no modems may be
> attached," that's the law. (I don't know the current status, but at
> one time there were severe restrictions, heavy fees, etc.)

European telecommunication is (slowly) being deregulated and 
demonopolized.  For instance we now have two competing companies offering 
mobile telephony services in Norway -- not bad for a country of just 4 
million people :-)

> "Orderly societies" like those in Europe prize order and control over
> the "cowboy" aspects of America.  Just because the American debate
> over Clipper and Digital Telephony is so loud and angry here in the
> U.S. is no reason to believe that the same measures are not already
> being put into place in Europe and parts of Asia.

Perhaps the problem is that we don't have a "critical mass" of concerned 
people.  The EU is not as integrated as the US (and Norway is not even a 
member!) so these matters are usually left to individual (and small) 
countries.


-- Rolf


----------------------------------------------------------------------
Rolf Michelsen         Phone:  +47 73 59 87 33
SINTEF DELAB           Email:  rolf.michelsen@delab.sintef.no
7034 Trondheim         Office: C339
Norway
----------------------------------------------------------------------

-----BEGIN PGP SIGNED MESSAGE-----

> Quite a bit of work has already been done on this concept.
> Basically one generates a very large sequence of machine
> instructions which computes the image of the output of an
> algorithm under a strong cipher from the image of the input under
> the cipher.  A controlled amount of redundant information is
> added to both the input and output.  This yields a piece of code
> so obtuse and complex that nothing may be gleaned about what
> algorithm it is executing by observing it run.  Figuring out what
> it actually is doing is a cryptanalytically hard problem.  Also,
> determining a way of modifying the code which does not break it
> is a similarly hard problem.

> Once encased in such a module, an algorithm may be distributed
> with no fear that it will be stolen.  This raises interesting
> poblems with software patents, since one can not tell from such a
> module whether it is performing a function in a way which
> infringes.

Fascinating!!  Almost unbelievable!

Can you provide references?

	John E. Kreznar		| Relations among people to be by
	jkreznar@ininx.com	| mutual consent, or not at all.

-----BEGIN PGP SIGNATURE-----
Version: 2.3a

iQCVAgUBLZJwqMDhz44ugybJAQHYDQP/Qz7MyegFvt8DlwOlE81DjDTlogZeui8Q
SvOzliEsPJmuepPFNzltTp8W9AsWSKI3oq4608TmCO5A0oLlMiEhGKbsjxIuWZ5d
GjNUmOMVqtU3kPmp3ZfluXKW87z5Wx6KUXcibhVilTG0POC8KOboOPYjXaPWjr9j
MnFs7yG/dU4=
=E5iE
-----END PGP SIGNATURE-----

>> Quite a bit of work has already been done on this concept.
>> Basically one generates a very large sequence of machine
>> instructions which computes the image of the output of an
>> algorithm under a strong cipher from the image of the input under
>> the cipher.  A controlled amount of redundant information is
>> added to both the input and output.  This yields a piece of code
>> so obtuse and complex that nothing may be gleaned about what
>> algorithm it is executing by observing it run.  Figuring out what
>> it actually is doing is a cryptanalytically hard problem.  Also,
>> determining a way of modifying the code which does not break it
>> is a similarly hard problem.
> 
>> Once encased in such a module, an algorithm may be distributed
>> with no fear that it will be stolen.  This raises interesting
>> poblems with software patents, since one can not tell from such a
>> module whether it is performing a function in a way which
>> infringes.
> 
>Fascinating!!  Almost unbelievable!
> 
>Can you provide references?

This is not new.  It's been used for years by software companies in
copy-protection schemes.  Ask anyone who's ever "cracked" software. 
Copy-protection systems rely on the fact that someone can not easily
find and remove the algorythm which impedes duplication.  There are
three common ways of preventing this.  First, the code is encrypted in
layers and modules.  Each module decrypts the next layer and rescrambles
or erases the last.  This prevents the attacker from getting an overall
view of the program, as it is never all accessable at once, but it can
be viewed in peices as it executes.  Secondly, several layers of
interpreted code can be used.  Each layer interprets the next.  In this
way, no assembly language code ever exists in plaintext (except the
first level interpreter).  Finally, the program checksums itself to
prevent tampering.  These methods can never provide foolproof
protection, but they can slow down attacks considerably.  Even the most
determined attacks can be delayed for weeks or months.  But if they want
it bad enough, they can probably reverse-engineer it - as has been said
before, crypto is all economics.

I've considered such possibilities for digital cash, but even if the
algorithm could not be derived from the cryptographically protected
software, it really doesn't solve the double-spending problem.  You can
just copy the entire module, along with all the money, and spend it
twice (on seperate victims, of course).
And all those layers of encryption can make it unbearably slow.

> This is not new.  It's been used for years by software companies in
> copy-protection schemes.  Ask anyone who's ever "cracked" software. 
> Copy-protection systems rely on the fact that someone can not easily
> find and remove the algorythm which impedes duplication.  There are
> three common ways of preventing this.  First, the code is encrypted in
> layers and modules.  Each module decrypts the next layer and rescrambles
> or erases the last.  This prevents the attacker from getting an overall
> view of the program, as it is never all accessable at once, but it can
> be viewed in peices as it executes.  Secondly, several layers of
> interpreted code can be used.  Each layer interprets the next.  In this
> way, no assembly language code ever exists in plaintext (except the
> first level interpreter).  Finally, the program checksums itself to
> prevent tampering.  These methods can never provide foolproof
> protection, but they can slow down attacks considerably.  Even the most
> determined attacks can be delayed for weeks or months.  But if they want
> it bad enough, they can probably reverse-engineer it - as has been said
> before, crypto is all economics.
> 
> I've considered such possibilities for digital cash, but even if the
> algorithm could not be derived from the cryptographically protected
> software, it really doesn't solve the double-spending problem.  You can
> just copy the entire module, along with all the money, and spend it
> twice (on seperate victims, of course).
> And all those layers of encryption can make it unbearably slow.
> 
> 

	Ever been on a "private" bbs, or talked to peole who (talk to 
people, who talk to people, etc.)have been on one? You get software 
released on 4 Jun (for example), on 6 June it's cracked, and by 7 June, 
it is available on every single continent (barring Antarctica - although 
i'm not certain about that - supposedly there are equally private 
internet nodes around somewhere...). While the might of bands like 
Paranoimia, Skid Row, and Razor 1911 are usually concentrated on games, 
their expertise applies equally well to "serious" software - it's just 
that games are more marketable/popular and thus get the crackers' names 
to more people.
	PS - the example above is an overestimate - it often happens that 
software is cracked and distributed within HOURS of release.

MJH

*       *       Mikolaj J. Habryn
                dichro@tartarus.uwa.edu.au
    *           "Life begins at '040."
                PGP Public key available by finger
    *           "Spaghetti code means job security!"