June 1993 - cypherpunks-legacy

Re: xor w/prbs
by collins＠newton.apple.com 18 Jun '93

18 Jun '93

While the pseudo-random bit sequence algorithm used in the Computer Shopper article is weak, it is important to note that the article is on the right track. However, a one time pad based on PRBS is only as secure as the PRBS itself. If the author did not state this, he was remiss. There *are* cryptographically strong pseudo-random bit generators. A one time pad based on a CSPRBS would be as secure as the underlying 'hard' problem. For example, Blum and Micali's paper "How to Generate Cryptographically Strong Sequences of Pseudo-Random Bits" (Nov. 84 SIAM), details a scheme based on the discrete log problem. Essentially, this system is based on selecting bits from successive exponentiations of a seed. If you could guess the next bit to be selected, without knowing the seed, you could reverse this into an algorithm to solve the discrete log problem. The Blum and Micali paper also references a paper by Shamir (which I have not read) called "On the generation of cryptographically strong pseudo-random sequences" 8th International Colloquium on Automata, Languages and Programming, Lecture Notes in Coputer Science, 62, Spring-Verlag, New York, 1981. The difference being that the Shamir scheme generates *numbers* while the Blum/Micali scheme generates *bits*. I try never to label anyone a moron until I am sure their stupidity is not just my failure to communicate. Scott Collins | "Few people realize what tremendous power | there is in one of these things." | -- Willy Wonka ...................................................................... Apple Computer, Inc. | phone: 408 862-0540(v), 974-6094(f) 1 Infinite Loop, MS 301-2C | AppleLink: SCOTTCOLLINS Cupertino, CA 95014 | internet: collins(a)newton.apple.com

1 0

Re: fast des
by smb＠research.att.com 18 Jun '93

18 Jun '93

> Run your plaintext through compress first; remove the compress > header; then encrypt. Compression will screw up character frequencie s > (and use all eight bits) enough to make automated detection of a > successfully-broken encryption really darn hard. Especially if you > keep changing compression technology each message. Most encryption scheams use cypher block chaining or some other mechanism where a change in one block will affect every block to come after it, no? Given this, would inserting a block of random data at the begining of the datastream help? Probably not. The DES-crackers are already going to be looking at a couple of blocks, because in general, the cryptanalyst won't know the IV. But not knowing it only affects your ability to decrypt the very next block; you can still get the one after it. The decrypt equation for CBC mode is P[n] <- D(C[n]) xor C[n-1] That is, without knowing the IV -- C[0] -- you can't recover P[1]. But P[2] depends only on C[2] and C[1]. If P[1] is random garbage, you've actually made life a bit easier -- the block they can't recover isn't important.

1 0

Re: Blasting Bidzos Blather
by George A. Gleason 18 Jun '93

18 Jun '93

Oh, here goes another Big Bad Corporation abusing our rights...! Well, are there any Libertarians out there who will please speak up for the right of Bidzos & co to earn a legal profit any way they see fit...? Or am I, the token leftist in the crowd, going to stick my neck out solo on this one...? Pardon my rhetoric, but I find it truly amazing how the much extolled rights of private property can suddenly become a non-issue when you consider you've found a bigger issue. Some of us feel that way about ecology. -gg

3 2

re: fast des
by Jason Zions 18 Jun '93

18 Jun '93

>>Usually the limiting factor is examining the <ostensibly> decrypted data >>for statistically significant patterns indicating that you have the >>correct key. > >If you know that your plaintext is 7-bit ASCII, then you can reject if you >see too many 8th bits set. [ ... ] Hint for implementors: don't allow such >easy bit correlations in your plaintext. Run your plaintext through compress first; remove the compress header; then encrypt. Compression will screw up character frequencies (and use all eight bits) enough to make automated detection of a successfully-broken encryption really darn hard. Especially if you keep changing compression technology each message. Jazz

3 2

Re: fast des
by wcs＠anchor.ho.att.com 18 Jun '93

18 Jun '93

Steve Bellovin refers to Hans Eberle's paper on a GAs-based 1Gb/s DES chip, which is available on gatekeeper.dec.com under the SRC directory. The search time of 16 days for $1M, aka 1 day for $30M (incl. support chips), is fairly similar to Peter Wayner's Content-Addressible-Memory approach, which would cost an estimated $30M for a 1 day search. (Average search time is about half as long as exhaustive searches.) To put this in a cost-per-solution context, if you amortize over 5 years, that's about 4000 solutions, so that's a bit under $10K per solution. It's more expensive than David Sternlight's $25/solution guess, but it's interestingly small - certainly worthwhile for occasional national security applications, or robbing electronic funds transfer networks, (at least for the $1M slower version), and it's in the ballpark of the rental rate for Congressmen :-) (the Abscam folks paid $50K to Senator Harrison Williams for some light work...) Since Skipjack uses an 80-bit key, the NSA or other rich organizations with access to it ought to be able to get similar performance in 24-48 years, assuming speed doubling continues at its 1-2 year rate. We'd be better off with something with a longer key, such as triple-DES. Bill Stewart

2 1

Contempt of court
by Mike Godwin 18 Jun '93

18 Jun '93

Forwarded message:

4 4

My recent flame at Stanton
by fnerd＠smds.com 18 Jun '93

18 Jun '93

Stanton McCandlish <anton(a)hydra.unm.edu> recently quoted a rant of mine directed at him. I really thought directed it to him literally--that I mailed it to his address, not the list's. Stanton, I didn't mean to flame you in public. I apologize. This is the second time this has happened this week. I'm starting to think that when I created this "fnerd" mail account I accidentally created an alter ego--my evil twin who posts personal insults to mailing lists... I will try to be triply, not just doubly sure of what I'm doing and put lots of warnings on any such personal grouch mail: "I DIDN'T POST THIS; BETWEEN YOU AND ME; PLEASE DON'T QUOTE ME," etc. in control now--SEIG HEIL!--down! down!... --Steve Witham (aka fnerd) quote me, this WAS posted

1 0

Re: Contempt of court
by Duncan Frissell 18 Jun '93

18 Jun '93

("Perry E. Metzger") >>>It seems like its only a matter of time before other than >>>stopping the government from quartering soldiers in your home >>>except in time of war, there will be nothing more the courts >>>will prevent. That's the answer to the question: "The US Government violates 9 of the 10 amendments of the Bill of Rights every second of every day. What is the one Amendment of the 10 that they hold inviolate?" The Third: 3rd Amendment No soldier shall, in time of peace, be quartered in any house, without the consent of the owner; nor in time of war, but in a manner to be prescribed by law. Say, maybe that's an argument against the Clipper Chip! Aren't the NSA types sort of soldiers who want to be quartered in our telephones at our expense? Duncan Frissell Who possesses the worlds longest list of flaky legal arguments which will be an enormous source of entertainment to a federal judge some day. "Did you know that Federal Reserve Notes are not money?" ******************************************************************** * DUNCAN FRISSELL Attorney at Law, Writer, and Privacy * * CIS 76630,3577 Consultant since the Nixon * * Internet: Administration * * 76630.3577(a)compuserve.com * * or frissell(a)panix.com * * Easylink 62853962 * * Attmail !dfrissell * * TLX: 402231 FRISSELL NYK * * * * Privacy Checkup still only $29.95. Get yours today to * * find out how to dodge federal child registration. * * * * "Register Communists Not Kids. Fight SB 732 & 733 for * * national computer registration and tracking of every * * child in America." * * * ********************************************************************

1 0

Re: RRe: Blasting Bidzos Blather
by Fred Heutte 18 Jun '93

18 Jun '93

I beg to differ. I know about federal procurement regs a little, having been employed by a federal contractor for a decade and being one my own personal self now. They greased this process bigtime, and it has the ugly smell of politics all over it.

1 0

RRe: Blasting Bidzos Blather
by smb＠research.att.com 18 Jun '93

18 Jun '93

> > PKP is not going to go away when a few of its patents expire. > Right. Contracts and licensing arrangements can last much longer > than patents. > That's why it's so important to see the exact details of this latest > deal and find out why someone in the federal bureaucracy was greasing > the procurement skids. I repeat -- NIST had no choice, because PKP held all the patent cards. Even if you don't believe PKP's claim to all of public-key cryptography, both the Diffie-Hellman and Schnorr patents would most likely be infringed by DSA. You can argue with the specifics of the deal -- and with what NIST gave away in order to get the Clipper exemption through -- but they had to reach some settlement. Btw -- the deal is *not* final; the announcement is just the start of a 60-day comment period. --Steve Bellovin

1 0