December 2003 - cypherpunks-legacy

Re: Graph isomorphism based PK cryptosystems?
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 15:42 5/25/94 -0400, smb(a)research.att.com wrote: > This is one of the main > reasons behind such publications as the IBM Technical Journal--the > publication of results not worth patenting themselves, but definitely > worth preventing others from patenting. > >Actually, no. IBM has a separate publication for just that purpose. >The Technicnal Journal (and others like it) are intended as PR vehicles >and as gold stars for researchers -- that's an important part of our >salary, as it were. I think that you are refering to IBM's "Technical Disclosures" publication. Its entries are in the form of patents, presumably in less finished form. They carry thru the process of writing up the patent, at least in rough form, and then decide whether to go to the greater expense of patenting it. If they decide not to patent it they publish it in Technical Disclosures.

1 0

Re: PGP 2.6 is dangerous in the long term ?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> >What if (the cypherpunk community) comes out with a secure program that > >doesn't rely on RSAREF? Can it be done? > > Bizdos and gang will _still_ hold the patent on RSA-style public key > encryption. What you're suggesting is, in essence, exactly what Phil > Zimmerman did with PGP 1.0. There are three different problems here: - Doing secure programs without the RSAREF implementation of RSA; this has US patent license difficulties unless you buy their stuff. - Doing secure programs without the RSA algorithm - other public-key methods are available, such as Diffie-Hellman, though RSA has a lot of technical advantages for many applications. PKP/RSADSI own patents that expire in 1997 that they claim cover the whole field of public-key crypto, and nobody's challenged the breadth of those claims in court. - Doing secure programs without public-key algorithms at all - you *can* use secret-key algorithms to do security, as long as you're willing to do key distribution by some usable but inconvenient method, and security systems like Kerberos can do this. But Public-Key variants solve a lot of the technical difficulties and make implementations much easier.

1 0

Re: SUE - the legal morass (fwd)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Was the dinosaur encrypted? Yes, but the key diddn't have enough bits to protect it for more than 50 million years under attack by the Feds :-)

1 0

(fwd) FBI Digital Telephony Wiretapping a Done Deal??
by bart＠netcom.com 17 Dec '03

17 Dec '03

From alt.politics.crypto, several forwards deleted: >US NEWS & WORLD REPORT, May 30, l994 >THE FREEH LOBBY. Thanks to intense personal lobbying by FBI >Director Louis Freeh, there are now sufficient votes on Capitol Hill to >assure passage of legislation that would make it far easier for law >enforcement officials to wiretap the nation's telephone system. The >snoop-friendly measure, which may be introduced this week, would >require manufacturers of telephone, computer and cable >communications equipment to design and build their machines so >that they could be readily accessed by wiretap and other types of >eaves-dropping devices used my US law enforcement agencies. The >legislation would cover communications equipment now in use as well >as items not yet on the drawing board.

2 1

Re: Magazines commonly predate issues, e.g. June Byte at hand
by jpp＠jpplap.markv.com 17 Dec '03

17 Dec '03

Oops. Boy, that was sure a snide, surly thing for me to say. Let me publicly apologise to you Harry, and to the readers of Cypherpunks. I though US News & World Report was a news paper, but that doesn't really excuse my tone. Sorry again. j'

1 0

Re: (fwd) FBI Digital Telephony Wiretapping a Done Deal??
by sidney＠apple.com 17 Dec '03

17 Dec '03

jpp(a)jpplap.markv.com (Jay Prime Positive) said: >> >US NEWS & WORLD REPORT, May 30, l994 >A little early with this report aren't you? Weekly magazines are displayed on newstands for more than one day and are labeled with the end of their expected display period so that potential customers will not think that they are out of date. Similarly, people who have subscriptions should receive the magazine before the date on the cover. I guess news is like milk: You get it before the expiration date that's printed on the label. -- sidney markowitz <sidney(a)apple.com>

1 0

dispersed DES
by David C. Taylor 17 Dec '03

17 Dec '03

I have come up with (and implemented) a version of triple DES for true paranoids, which I call dispersed DES. All I do is append four bytes to the beginning of the output files for each cycle of triple DES. It seems like this should provide even more security than triple DES, but I am no expert. Any comments? Please include "dct(a)newt.cs.byu.edu" in your replies, as I am unable to maintain access to the mailing list because of volume. Thanks. David C. Taylor dct(a)newt.cs.byu.edu

1 0

No Subject
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

ftp.netcom.com//pub/mpj has source for new macpgp

1 0

Re: dispersed DES
by Matt Blaze 17 Dec '03

17 Dec '03

In local.cypherpunks you write: >I have come up with (and implemented) a version of triple DES for true >paranoids, which I call dispersed DES. All I do is append four bytes to >the beginning of the output files for each cycle of triple DES. It seems >like this should provide even more security than triple DES, but I am no >expert. Any comments? Please include "dct(a)newt.cs.byu.edu" in your replies, >as I am unable to maintain access to the mailing list because of volume. >Thanks. >David C. Taylor >dct(a)newt.cs.byu.edu You have to be really careful when you invent new cipher modes, almost as much as when you invent an entire new cipher. It sounds like you have weakend 3-DES. Where do you get these 4 bytes? If they are fixed or deterministically generated, you will have made it possible for an attacker who can brute-force 1-DES (e.g., with a Weiner machine) to "peel off" each single DES key. Instead of a 112 (or 168) bit work factor (as with 3-DES), you'd end up with a 57 or 58 bit work factor. If you randomly generate the 4 bytes, you have to carefully evaluate your random number method. In any case it sounds like your mode is the weaker of 3-des and 1-des*(the complexity of your random bit generator). Perhaps I don't understand how your scheme works. Also, what intuition makes you think that it's stronger than plain old 3-DES? -matt

2 1

Re: IBM's NetSP
by habs＠warwick.com 17 Dec '03

17 Dec '03

> > e.g., not very secure from a serious peeping tom.... > > /hawk > And people say the export laws have no effect on U.S. domestic crypto > software... > Jim_Miller(a)suite.com Agreed... 40 bit key feels like (to me) one of those locks that comes on suitcases that you could probally break open with a small hammer.. /hawk

3 2