December 2003 - cypherpunks-legacy

Re: standard for stegonography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

>Now that I think about it, one wouldn't have to sacrifice any bandwidth >whatsoever! As, the stego program could be made to do wrap-around >encoding. Indeed, that's what I implemented. The current man page is appended. --- Jef pnmstego(1) USER COMMANDS pnmstego(1) NAME pnmstego - insert a stegonographic message into a portable anymap SYNOPSIS pnmstego [-offset n] [-components rgb] [-bitsched 10010...] file [pnmfile] DESCRIPTION Reads a portable anymap as input. Hides another file within the anymap by changing the low-order bits of each pixel, and writes the modified anymap to standard output. Stegonography means "hidden writing" - it's for storing a message in such a way that an opponent won't even be sure that the message is there, let alone be able to extract, decrypt, and read it. Pnmstego lets you store a file in the low-order bits of a PPM or PGM image. For a typical maxval of 256, this means the pixel values will be changed by only 1/256, which should not be noticable to someone viewing the image. Only PGM and PPM images may be used - trying to hide a file in a PBM image would be easily visible, so it's not allowed. OPTIONS The program has a bunch of flags that let you specify varia- tions on exactly how the bits are hidden in the image. If you don't specify any flags, the default options give you a reasonable storage method, to wit: -offset 0 -components b -bitsched 1 Letting the options default like this has the advantage that you can send a stegoed file to someone without having to specify what flags you used. You can also put the file on a public FTP server for people to retrieve, without needing any other communication. However, there is a disadvantage: people who the file is not intended for will be able to extract it too. If the resulting file is recognizable in some way, for instance if it's encrypted by PGP, then some of the purpose of the stegonographic storage will have been compromised. (A PGP file has a standard header and stores, in cleartext, the keyid needed to decrypt a file.) So, if you want the file to be absolutely positively hidden, you can use non-default settings for the options. Just don't forget what settings you used, and remember that if you want to send the file to someone else you will have to communicate the necessary settings somehow. Now, as for what the options do: -offset Specifies how far into the image to start. If the file runs off the end of the image, it wraps around back to the beginning, so don't worry about specifying too large an offset. In fact, you can even specify an offset larger than the image size - the initial value gets wrapped around too (modulus). Basically, any 32-bit number can be used. -components This lets you specify which of the red, green, or blue color components is used for storing bits. You give it a string made up from one or more of the letters r, g, and b. The default is b, use only the blue component. See the section below on quantization for why the default isn't rgb. If the input image is a PGM file, instead of PPM, this option is silently ignored. -bitsched This lets you skip using some possible bit posi- tions in the image. If the file you're hiding is not so big that you need the whole image to store it, you can use this option to hide it better. The argument is just an arbitrary- length string of 1's and 0's - the 1's say which bit positions should be used, and the 0's which should be skipped. The default is to use all bit positions. QUANTIZATION Normally, to store an image in a colormapped file format such as GIF, you first run it through ppmquant. However, if you try to quantize, then stego, and then convert to GIF, you will find that the ppmquant step will fail with an error about too many colors. This is because the stego step increased the number of colors. You might think, ok, stego first, then quantize; nope, the quantization would destroy the stegonographic message. Here's what you do instead: quantize down to half the number of colors you want in the final file, and then use only one of the three color com- ponents to store the hidden file. Using only one bit per pixel, the number of colors can at most double. This is why the default for the -components flag is to use only blue. So, the pipeline to use is: ppmquant 128 image.ppm | pnmstego message.txt | ppmtogif > hidden.ppm SEE ALSO pnmdestego(1), pnm(5) AUTHOR Copyright (C) 1994 by Jef Poskanzer.

1 0

Re: ditz in office
by Duncan Frissell 17 Dec '03

17 Dec '03

Even if the normal parts of the Bush and Clinton Administrations are equally fascist, the Clinton Administration would win in net fascism since it includes an added (unelected) fascist element missing from the Bush administration: Linda Stasi reports in her column "Hot Copy" in the New York Daily News today (Tuesday, March 1, 1994) that she and some other gossip columnists were invited to have tea with Hillary Clinton yesterday. [Hillary was in town to boost her health care program with a visit to a very recently improved Kings County Hospital. The units Hillary visited were specially scrubbed for her visit and contained fewer patients than usual.] Linda says Hillary "...never wants to run for public office herself. But she'd probably get elected in a minute." Think again Linda. You also provided us with another one of those `Hillary's Ominous Quotes of the Day': "AT A CERTAIN POINT, YOUR RIGHTS MUST BE ABRIDGED FOR THE PUBLIC GOOD." The statement might simply be her response to a question about convicted rapists not having to submit to an AIDS test. And then again, it might not. --- WinQwk 2.0b#1165

3 2

Re: standard for stegonography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

I wrote: >offset, wrap-around, bit schedules Actually, that interface is way too complicated and still not that secure. How about if the user just specifies a seed for a random number generator. Then that generator is used to make a *permutation* of the bit locations in the image, and the file's bits are stored in the permuted order. And look, this hides the file-length longword and any fixed file header real well, by spreading them through the image. Now I just have to find a simple but robust RNG that I can include in pbmplus, and some code to generate a permutation of a specified size. I'm not going to have ITAR problems with this, am I? RNGs are still legal to export? Oh, and to answer the original question: no standard. If this idea works, it's clearly better than existing stego systems at hiding the data; that's more important than interoperability. --- Jef

1 0

ditz in office
by tim werner 17 Dec '03

17 Dec '03

>From: cowen(a)glia.biostr.washington.edu > >now i wish i had not voted for the ditz in office. I wish everyone who voted either Republican or Democrat instead of Libertarian because they didn't want their vote to be wasted would take a moment to consider how their vote would have meant any less if they had voted for Andre Marrou and Nancy Lord in '92. Also, those who do not vote because they feel it just encourages the bastards should consider voting Libertarian next time. And those who voted for Perot as a protest, why not vote for freedom next time? tw

4 5

Freehdom Isn`t Freeh
by Duncan Frissell 17 Dec '03

17 Dec '03

New York Times, Monday, February 28, 1994 Business Day A PUSH FOR SURVEILLANCE SOFTWARE By John Markoff In the age of computer communications and digital telephone calls, the American people must be willing to give up a degree of personal privacy in exchange for safety and security, the head of the Federal Bureau of Investigation said. In an interview on Friday, Louis J. Freeh, the F.B.I. Director, defended proposed legislation that critics say would turn the nation's telephone network into a vast surveillance system. He said taxpayers would be asked to pay up to half a billion dollars to develop and deploy the necessary network software. The Administration wants to impose new technology that would enable law- enforcement agents to gather a wealth of personal information by monitoring citizens' calling patterns and credit card transactions over the telephone network --- and over the two-way cable television networks being planned by cable and phone companies. The system would go well beyond the current wiretapping technology, because much of the information could be gleaned without the police or F.B.I. actually having to eavesdrop on specific voice or electronic-mail conversations. "The costs are high, but you have to do a cost-benefit analysis," said Mr. Freeh, who insisted that fighting terrorists and criminals was the Government's intention --- not playing Big Brother to the citizenry. `A Credible Solution' "The damage to the World Trade tower and the economic interests of the country are conservatively estimated at $5 billion," he said, citing last year's bombing of the World Trade Center in Manhattan. "I think the American people will agree that this is a credible solution to the problem we face." The Administration is trying to line up Congressional support for the legislation, called the Digital Telephony and Communications Privacy Improvement Act of 1994, before having it formally introduced. Government officials say traditional wiretapping is becoming increasingly more difficult because more and more phone calls and data communications are transmitted as streams of digital information --- representing the ones and zeros understood by computers. Thousands of such calls may intermingle on a public-network circuit at any moment. Proponents of the legislation say new software placed on computerized network switching equipment is necessary to help law enforcement sort through this traffic. But executives of McCaw Cellular Communications, the nation's biggest cellular telephone company, told Mr. Freeh and White House officials at a meeting on Thursday that their newest telephone switches already provide the surveillance capabilities requested in the legislation. Moreover, privacy advocates say the Government can point to no case in which digital network technology alone has impeded an investigation. And they note that in the World Trade Center case, it was not electronic communications but mundane bungling of vehicle and warehouse rentals that led to arrests. An Electronic Portrait Such critics have long warned that in the information age, it is possible to build a detailed model of an individual's behavior, political and sexual preferences, social network and travel itineraries simply by examining telephone-calling patterns and credit card purchases. Some capabilities were demonstrated when law-enforcement agents pieced together a chronological list of phone calls made by the people accused of plotting and carrying out the attack in January on the figure skater Nancy Kerrigan. But the type of software the Clinton Administration wants to add to the public communications network would make possible much more detailed records of individuals' electronic activities. "It will be possible to develop a life-size portrait about you as a person," said Jerry Berman, executive director of the Electronic Frontier Foundation, a Washington privacy-rights lobbying group. "This is not just about a phone number." For the Administration, having taxpayers rather than communications companies pay for the system is meant to dilute industry criticism of the plan, which has met resistance since it was disclosed a few weeks ago. Congressional support is difficult to gauge. "The bill has some significant problems we need to resolve," said Representative Don Edwards, Democrat of California and chairman of the House Judiciary subcommittee on civil rights. "The profiling and the tracking aspect of the bill is something we are concerned abut." A version of the legislation was first proposed in 1991 by the Bush Administration at the urging of the Justice Department. But unlike that version, the new bill would limit the surveillance to public networks and not include company phone systems --- private branch exchanges, or PBXs --- or private corporate computer networks. Despite those changes, civil liberties groups and some industry executives say they are concerned that the scope of the new bill would give law- enforcement agencies new access to a vast amount of "transactional," or billing, information related to the setup of a telephone call. Under current law, obtaining a subpoena to obtain transaction data from the telephone company is easier than getting a wiretap warrant to eavesdrop on actual conversations, which requires a judge to find probable cause that a crime has taken place. Mr. Freeh met with telephone industry executives at the White House on Thursday and with Congressional leaders on Capitol Hill on Friday in an effort to attract support for the bill. He said in the interview that he was willing to compromise by adding safeguards for transactional information. "I understand the privacy concern," he said. "My real objective is to get access to the content of telephone calls. With respect to the extraordinary amount of personal information that is generated by this new technology, we would consider some way to block some of that information or raise the standard required to gain access. We're flexible on that." The F.B.I. Director said new digital communications technologies were making it more difficult for authorities to listen to conversations of suspected criminals who may be using cellular telephones or whose conversations may be carried as data streams in networks of fiber optic cables. Mr. Freeh said wiretapping had long been one of law enforcement's most effective tools. He cited examples in which it had been used effectively to prevent crimes, including a case in Chicago in which a terrorist was planning to shoot down an airliner with a Stinger missile. In that instance, Mr. Freeh said, The telephone networks involved were not advanced digital systems, but older analog networks that send voices as electronic patterns mimicking natural sound waves. But he said there had already been hundreds of cases in which attempted F.B.I. wiretaps had been thwarted by new digital communications technology --- not, he said, because the suspected criminals were necessarily trying to evade detection, but simply because the public-network technology made it difficult for agents to listen. Last year, a group called the Computer Professionals for Social Responsibility obtained Government documents through a Freedom of Information request indicating that an informal survey of F.B.I. offices in Newark, Philadelphia and Las Vegas, Nev., found no instances in recent years in which F.B.I. agents had encountered any technology- based problems in conducting wiretaps. Asked about those findings, Mr. Freeh said he was not aware of them. Several telephone industry executives who met with Mr. Freeh at the White House last week said that they were skeptical whether new legislation was needed and that they were concerned about provisions that would fine telephone companies up to $10,000 a day for failing to comply with the new law. "This is just new faces giving the same pitch," said one telephone industry vice president who attended the meeting and who had been opposed to the Bush Administration's version of the legislation. He spoke on condition of anonymity. Executives at the American Telephone and Telegraph Company said they did not believe there were significant technological problems that warranted new legislation. They also said they feared that the proposed legislation would undercut the privacy expected by customers. "Clearly the privacy concern is the biggest concern for A.T.&.T.," a spokesman for the company, Herb Linnen, said. He said the company would continue to meet with the White House and Justice Department in an effort to narrow the bill. Industry executives and privacy advocates have also warned about abuses of new surveillance technologies by telephone company insiders and computer vandals. But the F.B.I. Director said the protections in current analog telephone systems would be adequate to deter most break-ins. "This is always a threat," Mr. Freeh said. "But it's de minimus if you consider the alternative, which is not giving law-enforcement and intelligence agencies these capabilities." A White House official said that he believed opponents of the legislation were overreacting and that the law was a good compromise between privacy and law-enforcement needs. "The authority to gather transactional information already exists; I don't think this expands that authority," said John Podesta, the White House staff secretary. "We're open to talking through the issue with the privacy community." ----- Keyboarding by Lois Roth --- WinQwk 2.0b#1165

3 2

Re: standard for steganography?
by plaz＠netcom.com 17 Dec '03

17 Dec '03

Jim choate <ravage(a)wixer.bga.com> wrote: >I have played w/ stego some and w/ the present resolutions of images I dont >find the images have enough complexity to really hide a message of a useable >length, unless you break it up into several images. Present resolutions? What directions do you think it needs to go? Stego handles 24 bit TrueColor (actually 32 bit, but Romana wisely decided not to stuff data in the almost always blank alpha channel), and as many DPI as you have memory for. I don't think there is much call for deeper color resolution. It's true that GIF only accepts 8-bit color and the defacto standard internet transmision format for higher resolutions JPEG is a lossy compression that annhilates the message. Is this what you are refering to? >I use a function to measure the complexity of a image based on adjacent bit >changes. The more complex an image the more bit changes. I measure it thus: > ># of adjacent bit changes in image/ # of bits in image = complexity > >if the complexity is too low or too high (this is counter intuitive) then you >can't hide a message. Consider an image w/ only a few bit flippings, any >message that is inserted will cause the visual image to be distorted in a >noticable way (unless it is truely expressionistic). Now consider a image w/ >every other bit flipped (maximum complexity) which is in effect a >checkerboard. Any bits that get flipped change the pattern to a less complex >one (ie the checkerboard is broken up). Also you have to consider the effects >on edges and the standard deviation inherant in using anti-aliasing. This >will cause bits on the edge to be switched incorrectly for the algorith in >use. Since it is a trivial problem to measure the sd for various graphics >packages this makes a nifty test bed for finding imbedding images. Blank or >mono-chromatic areas also show the same type of errors. Yes, it is recommended that noisy images are used as the message envelope. Scanned or Frame-grabbed are good for this kind of thing. _______________________________________________________________________ Geoff Dale -- Cypherpunk/Extropian -- Plastic Beethoven AnarchyPPL - Anarch (Adjudicator) ExI-Freegate Virtual Branch Head plaz(a)netcom.com 66 Pyramid Plaza plaz(a)io.com Freegate, Metaverse(a)io.com 7777 "Subvert the domination paradigm!"

1 0

Re: standard for stegonography?
by plaz＠netcom.com 17 Dec '03

17 Dec '03

Jef Poskanzer <jef(a)ee.lbl.gov> writes: >>Well, try using Stego on an 8 bit PICT, and see for yourself! >>It looks like a >slight< random noise filter was applied to >>the image - plausibly the sort of trouble one would have with >>a slightly imperfect scanner. > >Maybe colormaps on the Mac are always sorted? That would minimize >the visible effect of +-1 changes in index value. Colormaps on the Mac are not "always" anything, since creating custom pallettes is trivial, but yes, they usually are. For best stegonagraphy in 8-bit, I would recomend using the system greyscale pallette. (Greyscale images *almost always* sorted on the mac.) _______________________________________________________________________ Geoff Dale -- Cypherpunk/Extropian -- Plastic Beethoven AnarchyPPL - Anarch (Adjudicator) ExI-Freegate Virtual Branch Head plaz(a)netcom.com 66 Pyramid Plaza plaz(a)io.com Freegate, Metaverse(a)io.com 7777 "Subvert the domination paradigm!"

1 0

It's the philosophy, stupid!
by frode＠toaster.SFSU.EDU 17 Dec '03

17 Dec '03

It's now quite a while since I promised to write something about how the U.S. is starting to look more and more like the Weimar Republic just before Hitler came to power. However, I am simply out of band- width, and will try to get away with recommending the book where I first picked up this idea: "Ominous Parallels" by L. Peikoff The book reveals the philosophical premises of today's Liberals *and* Conservatives and shows how they would fit right into Weimar. In the end, Hitler was the man who promised to implement the ideals of both the right (order, restraint of workers etc.) and the left (social programs, restraint of businessmen.) Both the Protestants and the Catholics praised Hitler, for "increasing the moral standard" of the country. Finally, Ayn Rand's "Atlas Shrugged" is a novel which offers a rather stunning commentary to the words of both Bush and Clinton. Indeed, it was "Atlas Shrugged" which finally prompted me to abandon the super-socialized Norway and move to the U.S.; and here I am watching it grow ever-more statist. :-) As for anyone already aware of / curious about Rand's philosophy, Objectivism, I'll be happy to (per email) answer questions, point them to discussion lists and so on. Frode Odegard

1 0

No Subject
by nobody＠jarthur.claremont.edu 17 Dec '03

17 Dec '03

Hi All... No no answer to the swiss bank question... Duncan... if you KNOW positively then your answer is OK... otherwise if you are shooting from the HIP please refrain... A definitive answer to this question is needed... and currently its unknown... anon

1 0

APPLIED CRYPTOGRAPHY - Errata 1.5.6 - March 2, 1994
by schneier＠chinet.com 17 Dec '03

17 Dec '03

APPLIED CRYPTOGRAPHY ERRATA Version 1.5.6 - March 2, 1994 This errata includes all errors I have found in the book, including minor spelling and grammatical errors. Please distribute this errata sheet to anyone else who owns a copy of the book. Page xvii: Third paragraph, first line: "Part IV" should be "Part III". Page 1: First paragraph, fourth line: "receiver cannot intercept" should be "intermediary cannot intercept". Page 6: Sixth and seventh lines: "against symmetric" should be "against a symmetric". Page 8: Second paragraph, first line: "q code" should be "a code". Page 10: Second paragraph, fifth line: Reference "[744]" should be "[774]". Page 11: Second paragraph: "The rotations of the rotors are a Caesar Cipher" should be "Each rotor is an arbitrary permutation of the alphabet". Page 13: Third paragraph: Delete parenthetical remark. Fifth paragraph, first line: "Shift the key" should be "shift the ciphertext". Page 15: Section 1.3, first line: "Throughout the book use" should be "Throughout the book I use". Page 25: "Attacks Against Protocols," first paragraph: "the protocol iself" should be "the protocol itself". Page 27: "One-Way Functions," fourth paragraph: "For example, x^2" should be "For example, in a finite field x^2." Page 28: Third paragraph, third and fourth sentences should be "How to put mail in a mailbox is public knowledge. How to open the mailbox is not public knowledge." Page 30: Fourth line: "symmetric cryptosystems: by distributing the key" should be "symmetric cryptosystems: distributing the key". Page 30: "Attacks Against Public Key Cryptography," second paragraph: "The database also has to be protected from access by anyone" should be "The database also has to be protected from write access by anyone". Also: "substitute a key of his choosing for Alice's" should be "substitute a key of his own choosing for Bob's". Page 30: Last line: "substitute that key for his own public key" should be "substitute his own key for that public key". Page 32: Ninth line: Delete the word "encrypted". Page 34" "Signing Documents with..." First sentence: "too inefficient to encrypt long documents" should be "too inefficient to sign long documents". Page 36: Second line: "document encrypted with" should be "document signed with". "Multiple Signatures," step (2): "Alice or Bob sends" should be "Alice sends". Page 38: Fifth paragraph: "V_X = E_X and that S_X = D_X" should be "V_X = E_X and S_X = D_X". Page 40: Third line: "computer can exist" should be "computer can be". Second paragraph: Delete "should be runs of zeros and the other half should be runs of ones; half the runs". Page 50: Step (3): "With Alice's public key" should be "with "Alice's" public key." Page 51: Step 5: "with what he received from Bob" should be "with what he received from Alice". Page 55: Step (2): At the end of the step, add: "He sends both encrypted messages to Alice." Page 69: Last line: "tried to recover her private key" should be "tries to recover Alice's private key". Page 73: "Bit Commitment Using One-Way Functions," last paragraph: Second and third sentences should be "Alice cannot cheat and find another message (R_1,R_2',b'), such that H(R_1,R_2',b') = H(R_1,R_2,b). If Alice didn't send Bob R_1, then she could change the value of both R_1 and R_2 and then the value of the bit." Page 77: "Flipping Coins into a Well," first line: "neither party learns the result" should be "Alice and Bob don't learn the result". Third line: parenthetical remark should be: "Alice in all three protocols". Page 78: Step (1): "Alice, Bob, and Carol all generate" should be "Alice, Bob, and Carol each generate". Page 80: Second paragraph, second sentence. It should read: "A general n-player poker protocol that eliminates the problem of information leakage was developed in [228]." Page 90: Last paragraph: "step (3)" should be "step (4)". Page 91: Second line: "step (3)" should be "step (4)". Page 93: "Blind Signatures," first line: "An essential in all" should be "An essential feature of all". Page 98: First paragraph after protocol, fourth line: "to determine the DES key with the other encrypted message" should be "to determine the DES key that the other encrypted message was encrypted in." Page 115: "Protocol #2," third paragraph: "together determine if f(a,b)" should be "together determine f(a,b)". Page 121: Second paragraph: Delete the colon in the third line. Page 131: Fifth paragraph: "each capable of checking 265 million keys" should be "each capable of checking 256 million keys". Page 133: Table 7.2: Third number in third column, "1.2308" should be "0.2308". Page 134: Table 7.3: "1027" should be "10^27". Page 139: Indented paragraph: "could break the system" should be "could break the system within one year". Page 141: "Reduced Keyspaces," last sentence: "don't expect your keys to stand up" should be "don't expect short keys to stand up". Page 148: Eighth line: "2^24" should be "2^32". Page 156: Second paragraph: "blocks 5 through 10" should be "blocks 5 through 12". Page 157: Figure 8.2: "IO" should be "IV". Page 159: Figure 8.3: "IO" should be "IV". Page 161: Figure 8.5: "Decrypt" should be "Encrypt". Page 162: Figure 8.6: "Encipherment" diagram: "Decrypt" should be "Encrypt". Input should be "p_i" instead of "b_i", and output should be "c_i" instead of "p_i". Page 164: Figure 8.7: "IO" should be "IV". Page 165: Last equation: There should be a "(P)" at the end of that equation. Page 167: Second paragraph, last line: "2^(2n-1)" should be "2^(2n-14)". Page 168: Figure 8.8: This figure is wrong. The encryption blocks in the second row should be off-centered from the encryption blocks in the first and third row by half a block length. Page 174: Middle of page: Equations should be: k_2 = c'_2 XOR p', and then p_2 = c_2 XOR k_2 k_3 = c'_3 XOR p_2, and then p_3 = c_3 XOR k_3 k_4 = c'_4 XOR p_3, and then p_4 = c_4 XOR k_4 Page 175: Last paragraph, second line: "acting as the output function" should be "acting as the next-state function". Page 177: Diffie's quote, second to last line: "proposal to built" should be "proposal to build". Page 178: Figure 8.20: In "Node 2", the subscripts should be "D_2" and "E_3". Page 190: Fourth paragraph, last line: "to determine M" should be "to determine P". Page 191: First paragraph: "3.5" should be "6.8". "0.56" should be "0.15". "EBCDIC (Extended Binary-Coded Decimal Interchange Code)" should be "BAUDOT". "0.30" should be "0.76". "0.70" should be "0.24". Page 193: Second sentence: "Unicity distance guarantees insecurity if it's too small, but does guarantee security if it's high" should be "Unicity distance guarantees insecurity if it's too small, but does not guarantee security if it's high." Page 198: Fourth paragraph from bottom, second sentence: "If a and b are positive and a is less than n, you can think of a as the remainder of b when divided by n" should be "If a and b are positive and b is less than n, you can think of b as the remainder of a when divided by n". Page 199: Middle of the page: In the sentence "Calculating the power of a number modulo a number", a should not be italicized. Page 201: First line of code: Remove "assuming x and y are > 0". Page 202: Middle of the page: In the sentence "Now, how do you go about finding the inverse of a modulo n?" "a" should be italicized. Page 207: "Jacobi Symbol," formula: Variable "h" should be "a". Also, J(0,n) = 0. Page 209: Fourth paragraph: "If that value does not equal q" should be "If that value does not equal 1". Page 214: Last line: "n" should be "p". Lines 29, 30, and 31: "r" should be "a", and "gcd(p,r)" should be gcd(a,p)". Page 215: Lehman test, step 5: All three "(n-1)/2" should be exponents. Page 217: There should be an open parenthesis in front of the second "ln" in both exponents. Sixth paragraph: "Guassian" should be "Gaussian". Page 222: "Validation and Certification of DES Equipment," first line: "As part of the standard, the DES NIST" should be "As part of the DES standard, NIST". Page 223: Second to last paragraph, last line. Reference "[472]" should be "[473]". Page 225: Figure 10.2: L_i is taken from R_(i-1) before the expansion permutation, not after. And "L_(i)-1" should be "L_(i-1)". Page 227: Fourth line from bottom: "output positions that correspond" should be "output positions correspond". Page 228: Fourth paragraph, last line: "0 to 16" should be 0 to 15". Page 228: Fifth paragraph should read: "For example, assume that the input to the sixth S-box (that is, bits 31 through 36 of the XOR function) are 110010. The first and last bits combine to form 10, which corresponds to row 2 of the sixth S-box. The middle four bits combine to form 1001, which corresponds to column 9 of the same S-box. The entry under row 2, column 9 of S-box 6 is 0. (Remember, we count rows and columns from 0, and not from 1.) The value 0000 is substituted for 110010. Page 231: Table 10.9, sixth line: "80286" should be "80386". Page 233: The second two weak keys should be: 1F1F 1F1F 0E0E 0E0E 00000000 FFFFFFFF E0E0 E0E0 F1F1 F1F1 FFFFFFFF 00000000 Page 238: Next to last line before "Additional Results": "NSA's" should be "IBM's". Page 238: "Differential Cryptanalysis," third paragraph: "(1/16)^2" should be "(14/64)^2". Page 239: Figure 10.4: "14/16" should be "14/64". Page 242: Table 10.14: In "XORs by additions" line, "2^39,2^3" should be "2^39,2^31". In "Random" line, "2^21" should be"2^18- 2^20". In "Random permutations" line, "2^44-2^48" should be"2^33-2^41". Page 245: Line 11" "8 bits is" should be "8 bits was". Page 247: Section heading, "Cryptanalysis of the Madryga" should be "Cryptanalysis of Madryga". Page 250: The two functions should be: S_0(a,b) = rotate left 2 bits ((a+b) mod 256) S_1(a,b) = rotate left 2 bits ((a+b+1) mod 256) Note the difference in parentheses. Page 250: Figure 11.4: Note that a is broken up into four 8-bit substrings, a_0, a_1, a_2, and a_3. Page 251: Figure 11.6: The definitions for S_0 and S_1 are incorrect ("Y = S_0" and "Y = S_1"). See corrections from previous page. Also, "S1" should be "S_1". Page 254: "Security of REDOC III," second sentence. Delete clause after comma: "even though it looks fairly weak." Page 262: Figure 11.9: There is a line missing. It should run from the symbol where Z_5 is multiplied with the intermediate result to the addition symbol directly to the right. Page 263: Table 11.1: The decryption key sub-blocks that are Z_n^(m)-1 should be Z_n^((m)-1). Also, the second and third column of decryption key sub-blocks in rounds 2 through 8 should be switched. Page 265: Figure 11.10: There is a line missing. It should run from the symbol where Z_5 is multiplied with the intermediate result to the addition symbol directly to the right. Pages 266-7: Since the publication of this book, MMB has been broken. Do not use this algorithm. Page 267: Sixth line from bottom: Reference should be "[256]". Page 269: "Skipjack." First paragraph. Reference should be "[654]". Page 270: "Karn." Third paragraph. Last sentence: "append C_r to C to produce" should be "append C_r to C_l to produce". Page 271: Middle of the page: "(for example, MD2, MD5, Snefru" should be "(for example, MD2, MD4, Snefru". Page 272: Second to last line: "But it is be analyzed" should be "but it is being analyzed". Page 275: Second to last paragraph: "Using 1028 bits" should be "using 1024 bits". Page 277: First lines: The correct street address is "310 N Mary Avenue" and the correct telephone number is "(408) 735-5893". Page 281: Third paragraph: The correct street address is "310 N Mary Avenue" and the correct telephone number is "(408) 735-5893". Page 283: Table 12.2: "PRIVATE KEY: d e^(-1)" should be "PRIVATE KEY: d = e^(-1)". Page 286: Third paragraph: "Eve gets Alice to sign y," "y" should be italicized. Second to last line: "Eve wants to Alice to" should be "Eve wants Alice to". Page 287: Last line: Wiener's attack is misstated. If d is less than one-quarter the length of the modulus, then the attack can use e and n to find d quickly. Page 288: The correct street address is "310 N Mary Avenue" and the correct telephone number is "(408) 735-5893". Page 289: The correct street address is "310 N Mary Avenue" and the correct telephone number is "(408) 735-5893". Page 292: Fifth line: "sqrt(x/v)" should be "sqrt(1/v)". Page 294: Second and third lines: "Bob" should be "Victor." Page 295: First line: "t random integers fewer than n" should be "t random numbers less than n". Page 297: Last line: "when" should be "where". Page 301: Middle of the page: Delete the sentence "Since the math is all correct, they do this step." Page 302: Fourth line from bottom: "a" should be in italics. Page 303: "Authentication Protocol," step (1): Add "She sends x to Victor." Page 305: Third paragraph, parenthetical remark: "NIST claimed that having DES meant that both that both the algorithm and the standard were too confusing" should be "NIST claimed that having DES mean both the algorithm and the standard was too confusing". Page 306: Eighth line: "cryptographers' paranoia" should be "paranoia". Page 307: "Description of the Algorithm": "p = a prime number 2^L bits long" should be "p = a prime number L bits long". "g = h^((p-1)/q)" should be "g = h^((p-1)/q) mod p". Page 309: Third line: "random k values and then precompute r values" should be "random k-values and then precompute r-values". Page 314: Protocol, step (1): "when" should be "where". Page 319: There should be a blank line before "discrete logarithm:" and another before "factoring:". Fourth line from the bottom: "depends more on the" should be "depends on more than the". Page 321: Third line: "when h" should be "where h". Page 322: Second paragraph: "over 500 pairs of people" should be "253 pairs of people". Page 326: In the definition of h_i, "H_(i-1)" should be "h_(i- 1)". Page 330: Definitions of FF, GG, HH, and II are wrong. These are correct: FF: "a = b + ((a + F(b,c,d) + M_j + t_i) <<< s)" GG: "a = b + ((a + G(b,c,d) + M_j + t_i) <<< s)" HH: "a = b + ((a + H(b,c,d) + M_j + t_i) <<< s)" II: "a = b + ((a + I(b,c,d) + M_j + t_i) <<< s)" Page 336: "HAVAL," sixth line: "160, 92, 224" should be "160, 192, 224". Page 339: "LOKI Single Block": In computation of Hi, drop final "XOR M_i". Page 340: "Modified Davies-Meyer": In computation of H_i, "M_i" should be subscripted. Page 342: "Tandem Davies-Meyer": In computation of W_i, "M_i" should be subscripted. Page 345: "Stream Cipher Mac", first line:" "A truly elegant MDC" should be "A truly elegant MAC". Page 347: Formula: "aX_(n1)" should be "aX_(n-1)". Second paragraph: "(For example, m should be chosen to be a prime number.)" should be "(For example, b and m should be relatively prime.)" Page 351: Second line of text: "they hold current" should be "they hold the current". Page 353: Tenth line (in source code): "< 31" should be "<< 31". Second paragraph: "are often used from stream-cipher" should be "are often used for stream-cipher". Page 356: Source code: "ShiftRegister = (ShiftRegister ^ (mask >> 1))" should be "ShiftRegister = ((ShiftRegister ^ mask) >> 1)". Page 360: Equation should not be "l(2^1-1)^(n-1)", but "l(2^l- 1)^(n-1)". Page 362: Figure 15.10: "LFSR-B" should be "LFSR-A" and vice versa. The second "a(t+n-1)" should be "a(t+n-2)", and the second "b(t+n-1)" should be "b(t+n-2)". Page 363: Fourth paragraph: "cellular automaton, such as an CSPRNG" should be "cellular automaton as a CSPRNG". Page 365: "Blum-Micali Generator": In the equation, "x_i" should be an exponent of a, not a subscript. Page 367: Paragraph 5: "Ingmar" should be "Ingemar". Page 370: "Using "Random Noise," first paragraph, last line: "output 2 as the event" should be "output 0 as the event". Page 371: Sixth line: "access/modify times of/del/tty" should be "access/modify times of /dev/tty". Page 371: "Biases and Correlations," third line: "but there many types" should be "but there are many types". Page 376: Seventh line: "send a message, M" should be "send a message, P". Page 391: Second protocol, step (1): "in his implementation of DES" should be "in his implementation of DSS". Next sentence: "such that r is either q quadratic" should be "such that r is either a quadratic". Page 402: First line: "when" should be "where". Line 18: "2^t" should be "2^(-t)". Page 406: Step (5): "i<j" should be i>j". Page 417: Last paragraph: "Kerberos is a service Kerberos on the network" should be "Kerberos is a service on the network". Page 421: Figure 17.2: In the top message "C" should be lower case. Page 435: "RIPEM": "Mark Riorden" should be "Mark Riordan". Page 436: "Pretty Good Privacy," third paragraph: Delete fourth sentence: "After verifying the signature...." Page 436: Pretty Good Privacy is not in the public domain. It is copyrighted by Philip Zimmermann and available for free under the "Copyleft" General Public License from the Free Software Foundation. Page 437: Fifth line: Delete "assess your own trust level". "Clipper," second paragraph: reference should be "[473]". Fourth paragraph: references should be "[473,654,876,271,57]". Page 438: Middle of page: reference should be "[654]". "Capstone," first paragraph: reference should be "[655]". Page 445: The IACR is not the "International Association of Cryptographic Research," but the "International Association for Cryptologic Research." This is also wrong in the table of contents. Source Code: The decrement operator, "--", was inadvertently typesetted as an m-dash, "-". This error is on pages 496, 510, 511, 523, 527, 528, 540, and 541. There may be other places as well. Page 472: "for( i = 0; i<<16; i++ )" should be "for( i = 0; i<16; i++ )". Page 473: Function "cpkey(into)". "while (from endp)" should be "while (from < endp)". Page 508: Line 8: "union U_INITseed" should be "union U_INIT seed". Page 531: "for( i = 0; i<; i++ )" should be "for( i = 0; i<2; i++ )". Page 558: "#defineBOOLEAN int" should be "#define BOOLEAN int", "#defineFALSE0" should be "#define FALSE 0", and "#defineTRUE(1==1)" should be "#define TRUE (1==1)". Page 564: "#define BOOLEANint" should be "#define BOOLEAN int", "#define FALSE0" should be "#define FALSE 0", and "#defineTRUE(1==1)" should be "#define TRUE (1==1)". Page 569: "rand() > 11" should be "rand() >> 11". Page 569: In "G13.H", "#define G13int" should be "#define G13 int". Page 572: Reference [45]: "Haglen" should be "Hagelin". Page 576: References [136] and [137]: "Branstead" should be "Branstad." Page 578: Reference [184] "Proof that DES Is Not a Group" should be "DES Is Not a Group." The correct page numbers are 512-520. Page 589: Reference [475]: The publisher should be E.S. Mittler und Sohn, and the publication date should be 1863. Page 601: References [835] and [836]: "Branstead" should be "Branstad." Page 602: Reference [842]: "Solvay" should be "Solovay". Page 603: Reference [878]: "Weiner" should be "Wiener." This errata is updated periodically. For a current errata sheet, send a self-addressed stamped envelope to: Bruce Schneier, Counterpane Systems, 730 Fair Oaks Ave., Oak Park, IL 60302; or send electronic mail to: schneier(a)chinet.com.

1 0