August 1993 - cypherpunks-legacy

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 27 Aug '93

27 Aug '93

cdodhner(a)indirect.com (Christian D. Odhner) says: > I could very well be wrong about this one, but since pgp uses a random > idea session key each time you encrypt, wouldn't that in fact ensure that > no two encryptions of the same file with the same public key are ever the > same? Why then would random stuff be needed? I knew that! I forgot that! Thanks for reminding me. Back to the drawing board! A protocol where the user controlled the session key would be more awkward but would solve that problem. On the otherhand that isn't the PGP protocol.

1 0

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 27 Aug '93

27 Aug '93

Forwarding for cdodhner(a)indirect.com (Christian D. Odhner) > > peter honeyman <honey(a)citi.umich.edu> says: > > pgp and viacrypt will always generate differnt outputs: pgp > > adds some pseudo-random stuff to the start of the file it is > > encrypting to ensure that a file encrypts differently each time. > This means that I am trusting the "pseudo-random" stuff not to be > some secrets that PGP has read from my disk. The only benefit > that I see to the pseudo-random stuff is to send the same message > to several people without revealing the fact that the messages are > the same except to those that can decode the messages. > I could very well be wrong about this one, but since pgp uses a random idea session key each time you encrypt, wouldn't that in fact ensure that no two encryptions of the same file with the same public key are ever the same? Why then would random stuff be needed? Happy Hunting, -Chris <cdodhner(a)indirect.com> PGP public key available upon request.

1 0

.Comparing ViaCrypt and freeware.
by cjl＠micro.med.cornell.edu 27 Aug '93

27 Aug '93

{Refering to my earlier post about the possibility of black-boxing the commercial ViaCrypt and comparing it to freeware PGP} I've been most gratified by the response (private and posted) to my question. Thanks for the enlightenment. The first few responses were diametrically opposite in their conclusions, but after that what I have taken away as the message is that the session key is generated on-the-fly and would be different every time, although I guess I still don't understand enough to figure out why no matter what the program uses as randomness input some really bright boy capable of working real down close to the silicon couldn't fake up some sort of a test bed to spoon-feed the "randomness" to the program. It's not like this thing runs on quantum randomness. Is it? As for why bother when the freeware is available, plausible deniability was mentioned and I think that is probably the most convincing argument. The Jackson Games seizure, and other computer confiscations by law enforcement are enough to keep any company from allowing a copy of PGP on the premises, it also has a fairly chilling effect on those less brave souls who don't have the power of their convictions and are willing to trust the government not to snoop on their E-mail or phone conversations. The right to privacy can be eroded away because most people don't care to learn how the box on the desk works, let alone worry about exercising their civil liberties. Hell, most people don't even bother to vote. I found out about PGP from the WIRED article on the cypherpunks, and I have been doing as someone else suggested, turning other people on to privacy. I have converted several friends already and they in turn are spreading the encrypted word. eep-Kay o-nay rypting-'Cay, cjl

1 0

Re: Coming Soon: Commercial version of PGP!
by mbriceno＠aol.com 27 Aug '93

27 Aug '93

gg(a)well.sf.ca.us writes: > How soon before a Mac compatible version is available? Or will the > current version run under Soft PC on the Mac, which is essentially a > PC-emulator...? If yes to either, sign me up...! Have you tried the freeware version of MacPGP yet? It is very easy to use. The next release (now in beta) will even support AppleEvents. I think it will be quite a while before you can buy something similar. [And why would you want to pay if you can get for free?] --Marc

1 0

Re: Further PGP Security Doubts
by an31185＠anon.penet.fi 27 Aug '93

27 Aug '93

an31144(a)anon.penet.fi writes: ["Raymond Paquin"] >.. claims that PGP is fatally flawed, though the flaw is in niether >RSA or IDEA, but rather somewhere within the PGP part of the program. > >Copping the "I can say no more! I have said too much already!" >melodrama, no more detailed information is forthcoming. Yes, this seems to be a persistent rumour, though I've no idea how true it might be. I uploaded PGP to a bulletin board a few months back and received a message from another user claiming the same thing. (And taking the same copout...) I've been meaning to take a good look at the source for a while, I think it's about time to investigate the key generation code..... ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Coming Soon: Commercial version of PGP!
by an31185＠anon.penet.fi 27 Aug '93

27 Aug '93

>How soon before a Mac compatible version is available? Or will the current >version run under Soft PC on the Mac, which is essentially a PC-emulator...? >If yes to either, sign me up...! > >-gg(a)well.sf.ca.us Well, it works on SoftPC on my workstation, so I guess it would work on the Mac as well. I don't think I'd trust the key generation though, as if I remember correctly the PC version sets the PC timer to a high rate which SoftPC probably doesn't support. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 26 Aug '93

26 Aug '93

peter honeyman <honey(a)citi.umich.edu> says: > pgp and viacrypt will always generate differnt outputs: pgp > adds some pseudo-random stuff to the start of the file it is > encrypting to ensure that a file encrypts differently each time. This means that I am trusting the "pseudo-random" stuff not to be some secrets that PGP has read from my disk. The only benefit that I see to the pseudo-random stuff is to send the same message to several people without revealing the fact that the messages are the same except to those that can decode the messages.

1 0

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 26 Aug '93

26 Aug '93

thug(a)phantom.com (Murdering Thug) writes: > I'm assuming the NSA will pressure ViaCrypt to put in a backdoor. One > possible backdoor that can be placed inside the commercial PGP and still > allow it to pass the above test is if commericial PGP secretly writes all > keys and pass phrases to a block on your hard disk, and marks that > block as used to the file system. In order to prevent you from scanning > your hard disk and finding that block, the information stored there could > be encrypted by a key which the NSA has in it's possession. At least the Commercial PGP is not tamper proof and examination can, in principle, discover the backdoor. After discovery it would impossible to deny.

1 0

Re: Source Code NOT available for ViaCrypt PGP
by norm＠netcom.com 26 Aug '93

26 Aug '93

Regarding Secret key generation. cme(a)ellisun.sw.stratus.com (Carl Ellison) says: > The only place to worry is with key generation, > both IDEA and RSA. I presume this is true. I include a Scheme program that finds the first prime in an arithmetic sequence. It uses a function published in Knuth. You can either study my program or compare its output with some program written by someone else to the same spec. If people are interested I will annotate the code and its output better. As it is now the prime that it finds is the last number that it outputs before it stops. Curiously it has a probability of error which is large for small numbers but exceedingly small for large numbers, just the opposite of human testers. I claim that this is a good specification for choosing your secret primes. It has a slight advantage over merely finding the first prime beyond some specified number because that tends to find primes that follow long runs of composites. It just now (as I edited this) found the prime 1000000000000000 00000000000000000000000000000000000000000000000000000000000000913 as the first prime in the sequence 10^80+11*n. I typed (scan (expt 10 80) 11) to the interpreter to get this. It took several minutes. I used MacGambit on a 68030. The output theoretically depends on the hokey random number generator here but if two implementations yield different answers due to different random number generators Knuth and others would be very interested! For use in real RSA application we should include a function that hashes typed in text into a bignum. A good hash of long text is a very good random number! It need not be a crypto hash! (define (ex x)(write x)x) (define (rand31 seed) (lambda()(let* ((hi (quotient seed 127773)) (lo (- seed (* 127773 hi)))(test (- (* 16807 lo) (* 2836 hi)))) (set! seed (if (> test 0) test (+ test 2147483647))) seed))) (define (gbrand max seed)(let* ((rq (rand31 seed)) (nq (let v ((c max)(n 0))(if (< c (expt 2 31)) (cons (let w ((cx c)(nx 1))(if (< cx 2) nx (w (quotient cx 2)(+ nx 1))))n) (v (quotient c (expt 2 31))(+ n 1))))) (z (car nq))(n (cdr nq))(k (+ (* 31 n) z))) (write(list max k z n)) ; max, k, n, z, L and m are non-negative integers. ; 2^(k-1)<=max<2^k. k=31*n+z. 0<z<=31. ; I claim this code is efficient if ; (quotient .. (expt 2 ..)) and (modulo .. (expt 2 ..)) are efficient. (if (= n 0)(lambda () (let r ()(let ((q (modulo (rq) (expt 2 z)))) (if (< q max) q (r))))) (let ((L (quotient max (expt 2 (- k 31)))))(write L) ; max = L*2^(k-31) + m; 0<=m<2^(k-31). L is the high 31 bits of max. (lambda()(+ (* (expt 2 z)(let g ((nx n))(if (= nx 1) (let r ()(let ((q (rq)))(if (< q L) q (r)))) (+ (* (expt 2 31)(g (- nx 1)))(rq)))))(modulo (rq)(expt 2 z)))))))) (load "Random.scm") (define ww (lambda(n x)(display (list n x)) x)) ; The following definition is to ensure that modulo never ; produces negative numbers. (define modulo (let ((modulo modulo))(lambda (a m) (if (negative? a) (- (- m 1) (modulo (-(- m 1) a) m)) (if (positive? a) (modulo a m) 0))))) ; The following is the "Jacobi Symbol". (a|P) (define (j a P) (if (< a 2) (if (= a 1) 1 (if (= a 0) 0 (j (modulo a P) P))) (if (>= a P) (j (modulo a P) P) (if (even? a) (let((q (j (/ a 2) P)) (m (modulo P 8))) (if (or (= m 3)(= m 5))(- q) q)) (let((q (j (modulo P a) a))) (if(or (= (modulo P 4) 1) (= (modulo a 4) 1)) q (- q))))))) (define (mod-exp b p m)(cond ((= p 0) 1) ((even? p)(let ((x (mod-exp b (/ p 2) m)))(modulo (* x x)m))) (#t (modulo (* b (mod-exp b (- p 1) m)) m)))) ; The following is by Solovay & Strassen as presented in Knuth page 396. (define (p-test a P)(if(zero? a)(cdr 2))(and (odd? P) (= (gcd a P) 1) (zero? (modulo (- (j a P)(mod-exp a (/(- P 1) 2) P)) P)))) (quote "The function scan below returns the first prime in the") (quote "arithmetic sequence a + n*b") (define (scan a b)(let* ((g (gcd a b))(n (modulo b 210)) (random (gbrand (+ a (if (positive? b) 0 (* 2000 b))) 228765)) (probe (+ 1 (random)))) (if (> g 1) (list "Always divisible by" g) (let more ((a1 a)(m (modulo a 210))(cn 0)) (if (and (let all ((l (list 2 3 5 7)))(or (null? l) (and (positive? (remainder m (car l))) (all (cdr l))))) (let all ((l 20)(p probe)) (or (zero? l) (and (ww cn (pt p a1)) (all (- l 1)(+ 1 (random))))))) a1 (begin (display ",")(more (+ a1 b)(modulo (+ m n) 210)(+ cn 1)))))))) (define (pc wx) (let zz ((q (- wx 1))(s 0))(if (zero? q) s (zz (- q 1)(+ (if (p-test q wx) 1 0) s))))) ; The following prmality test is from second edition of ; volume 2 of Knuth's "The Art of Computer Programming", ; page 379. (define (pt x n) (or (= n 2) (let* ((pr (let z ((q (- n 1))(k 0))(if (odd? q)(cons q k) (z (quotient q 2)(+ k 1))))) (q (car pr))(k (cdr pr))(nm1 (- n 1))) (let lp ((j 0)(y (mod-exp x q n))) (or (and (= j 0)(= y 1)) (= y nm1) (and (< (+ j 1) k)(lp (+ j 1)(modulo (* y y) n)))))))) ; 10^100-797, 10^200-189, 10^299-171, 10^300-69 are prime. ~. ~.

1 0

Re: Source Code NOT available for ViaCrypt PGP
by smb＠research.att.com 26 Aug '93

26 Aug '93

btw, how did they get around PKP's rule about using the interface provided which uses DES ? That rule applies to RSAREF, and not necessarily to anything else.

1 0