- cypherpunks-legacy - lists.cpunks.org

Re: awards for hacking microsoft
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> What else, Chaum's Digicash. If you are unwilling to part with > any of your own, perhaps you can collect contributions, or maybe > the Digicash people will pony-up some extra cyberbucks for a good > cause. After all, they are worth the paper they're printed on. > :-) Don't tell that to the people on the ECM mailing list! People there have been trading cyberbucks for RealMoney. The last successful trade I saw was 100 cyberbucks for 4 UK pounds... andrew

2 1

SAIC bought InterNic, but who is SAIC? A spook contractor!
by John Gilmore 17 Dec '03

17 Dec '03

Forwarded-by: gordoni(a)base.com (Gordon Irlam) Thought you might find this interesting. I don't know if you have thought about it or not, but control over the root name service plus some funky software is all that it takes to be able to selectively snoop on all the packets addressed to any host on the net. DNS is currently the achilles heel of a secure internet... gordoni From: Wes Thomas <wes(a)ora.com> The press recently reported that the National Science Foundation has turned over Internet Domain Name registration to Network Solutions, Inc. (NSI) of Herndon, VA. The press failed to note some interesting connections. Tomorrow morning (Sept. 26), Web Review, a biweekly online magazine (see Special Report at http://gnn.com/wr/) will reveal that NSI was purchased in May by Scientific Applications International Corporation (SAIC) of San Diego. SAIC is a $2 billion company indicted by the Justice Department on ten felony counts for fraud in managing a Superfund toxic cleanup site (SAIC pleaded guilty) and sued by the Justice Department for civil fraud on an F-15 fighter contract. SAIC's board members include Admiral Bobby Inman, former NSA head and deputy director of the CIA; Melvin Laird, Nixon's defense secretary; and retired General Max Thurman, commander of the Panama Invasion. Recently departed board members include Robert Gates, former CIA director; William Perry, current Secretary of Defense; and John Deutch, the current CIA director. Current SAIC government contracts include re-engineering information systems at the Pentagon, automation of the FBI's computerized fingerprint identification system, and building a national criminal history information system. "At the very time the Internet community is struggling with the issues of encryption and privacy, I'm more than a little uneasy to find this bunch of ex-spooks sitting at the very entry point of the Net," says Jim Warren (a leading activist in making government records accessible) in the article, which was written by investigative journalist Stephen Pizzo, Web Review Senior Editor and co-author of the book Inside Job, an expose on the savings & loan looting. Web Review is produced by Songline Studios, an affiliate of O'Reilly & Associates.

2 1

worldwide announce: New OTP Mail/FTP apps
by Doug Hughes 17 Dec '03

17 Dec '03

A company in Israel named Elementrix has just announce at Interop an entirely new paradigm in secure transactions. They have a secure one time pad that allows people to exchange mail and ftp files back in forth in complete security without the worries of key management or storage or secure random number generation or synchronization. In the words of Winn Schwartau: "This really fucks with your brain" Both he and David Kahn have gotten information out of non-disclosure, as well as several other un-named experts in cryptography about the nature of this new development. They were astounded and have provided assurances as to its authenticity and ability to work as advertised. So far they have no released the complete protocol, but plan to do so as soon as the Patent issues pending in several countries have been resolved. The protocol will be completely published and subject to scrutiny by everybody. To me it looks like it would be trivial for them to integrate it into any and all kinds of browsers, clients and applications. Of course, I do not have a complete knowledge of the entire protocol, but the brief overview was simple enough to understand in concept. If it can work in FTP, it can surely work in telnet as well, it's just a different front end over a TCP/IP connection. I realize that there will be those out there on this list who will immediately dismiss this as a hoax, as would have I had I not seen it operate with my own eyes, and sat through the conference. It was a case of serendipity for me, showing up at the booth and getting an invite to the press conference on the one day I decided to attend Networld/Interop. It works something like this: (I may not have it completely right, but this is what I understood of the broken English of the man without the microphone) A third party generates random numbers, or one of the two communicating parties. The numbers do not have to be secret. There is also a published table of mappings.. Something like, a number, and an operation.. 1 -> add 23 2 -> add 21 3 -> add 40 4 -> add 57 90 -> sub 23 One initial connection is all that is needed to have a secure connection for the lifetime of the two communicating parties. This initial connection can be accomplished via any number of ways. It does involve an initial one time only shared secret. This is much different than the many shared secrets and key management issues of private and public key systems. For the initial connection you can stick the machines back to back if you are really worried about security. This initial transaction serves as a seed for subsequent transactions. All subsequent transactions depend on preceding transactions. A degree of randomness comes from the randomness of the messages. Each next word in the message is random. (the argument goes like this: If you already know what the next word in the message is, there is no point in sending the message in the first place, because you know what all the words in the message are.) This imparts some degree of randomness, as no two beings will have an entire conversation over their lives the same as their conversation with anybody else: similar arguments can be applied to file transfers. After the initial exchange every message sent subsequently gets randomized from the previous randomness of the messages plus something in the table. If somebody else makes an exact copy of your machine, and sends a message as you, then you can no longer send messages to the other party as you are out of sync, and an Intruder alert is flagged if you do try to send a message. Then you and the foreign party can resynchronize. This new state is the basis for new messages. Argument: "That's fine, but how to I communicate securely with someone over the Internet with email that I'm not able to setup a secure channel with." Apparently each distribution disk is encoded with a unique ID and some kind of unique (and as yet undisclosed table and algorithm). This table allows the two parties to somehow setup a secure session and send mail. This does not solve authentication problems. If somebody steals your disk and sends mail to someone, they can appear to be you (or anybody). However, the minute you try to send mail to that same person, there is state on the remote machine with the imposter that you do not possess that flags an intruder problem, and new negotiations can begin. However, snoopers of the original message will still be unable to decode the one time pad. Winn Schwartau and Dr. David Karn have both signed non-disclosure and both made announcements to the affect that it does work as advertised. Also, it is not strictly random numbers in the traditional sense. It relies on the fact that the message is composed of a random series of words to create the one time pad. However, the one time pad does not repeat itself due to the continuing diversity of subsequent messages. They have reviewed the math and the algorithms and stated that it's a completely new way to think about cryptography, and the math is valid. Usability: point and click.. Click on the little lock button and the message is encrypted on the fly. The mail browser decrypts the message on the fly. After it is decrypted it is stored on the hard drive in plain text. (As it would have to be, unless you encrypt it with some conventional secret-key algorithm like DES or IDEA). This is fine as they say you have to have some degree of physical security anyway, and this is only to protect you on the networks in between the two machines. I'm inclined to agree. Notes: It's fast!! I'm just telling you what I heard. I have no idea how or what is stored as state information if anything. (part of the currently undisclosed algorithm). I was very skeptical at first, but have affected cautious optimism at this point. (until it is published). I just have a couple things to add. If it's true and works as advertised, we're in for a real treat, and the NSA and FBI are going to be really upset. :) Those drug smugglers and kiddie porn pushers are going to be immune to network wire taps. Next step: illegal algorithms, illegal XOR. ;)

3 4

Netscape and privacy
by csmyth＠blaze.cs.jhu.edu 17 Dec '03

17 Dec '03

The Communications Week issue of September 25 1995 contains an interesting interview with Netscape Chairman Jim Clark in which he outlines the future that he envisions for his company. The interview also contains a passage discussing the Netscape browser software that I find somewhat disturbing. Many cypherpunk list members are concerned with the general issue of electronic privacy and with the programming of WWW browsers, so I think this post is relevant to the list. Clark's apparent attitude toward privacy makes me uneasy. Begin excerpt Comm Week: How do you track usage? Clark: We have worked out schemes to tell us when you use our program and for how long you use it. That capability is easy to add. We can tell each and every time you turn it on and we can tell whether you have paid for it or not. We were getting 10 million hits a day at our Web site. It has doubled since our IPO. End excerpt I personally oppose the collection of this type of behavioral tracking information without my explicit consent, and I would reconsider using software which implements the type of tracking Clark mentions above. Note, Clark's reply is ambiguous because it does not indicate if the `schemes' have been implemented or deployed at this time. Some list member associated with Netscape may wish to clarify Clark's comments. It is true that a user automatically contacts the Netscape Web cite when starting the browser if he or she has not reset the default home page. I reset my home page long ago, but I do not know if the Netscape site is still contacted anyway. Nor do I know if Netscape is contacted when I quit the browser, or if elapsed usage time is tracked. The future Clark posits for his corporation depends on people adopting Netscape software for a wide variety of tasks. He wants the browser to evolve toward being a general multimedia web browser, mail handler, newsreader, and collaboration tool. Such a tool would handle large amounts of private and/or proprietary information and the creator of such a tool must be extremely sensitive to privacy concerns in my opinion. Collecting and relaying information about usage is potentially a significant violation of the privacy users will expect. Certainly, it is tempting to gather information for marketing purposes and other reasons. For example, some browser company unconcerned about privacy might program its browser to regularly transmit information about bookmarks and histories to a database site for analysis and data-mining. But ignoring privacy concerns risks invoking the fervent ill-will of many users. Perhaps I am over-reacting to Clark's comments. Even if I am over-reacting, Netscape should consider developing a statement of its privacy policy and making it available at its web site. It is not easy to craft clear, concise and general privacy guidelines. Below are two crudely crafted suggestions for properties that should be satisfied by a browser. 1) Information about browser usage will never be collected and/or transmitted surreptitiously to any other agent on the net. 2) Transfer of information should be done openly with the explicit initiation/agreement of the browser user. Note, currently the Netscape browser (and other browsers) apparently transmit identification information such as the browser type, version number, and machine name when making a connection. The browser user should probably be told about this information in my opinion. Chris Smyth csmyth(a)blaze.cs.jhu.edu

5 4

Spoofing HTTP server certificates
by Greg Miller 17 Dec '03

17 Dec '03

Since there has been a lot of talk about the "man in the middle" attack on the secure web servers, has anyone actually considered the processing time required to fake a certificate from scratch? I haven't really familiarized myself with how the certificates are generated, etc, but it's my understanding that they are signed with RSA. The few recent factorings of RSA keys have shown that brute force attacks are feasable with distributed processing. Since these projects were done "just for the fun of it", wouldn't it seem likley that someone (or some people) would take the time and effort to factor the certificate signing key? After all, it would actually be worth something. gmiller(a)grendel.ius.indiana.edu http://www.ius.indiana.edu/~gmiller/

1 0

Not just Netherlands - Italy too.
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

I missed this one - the NSA stooge dropped it in passing at the CFP conference: : STU BAKER But look, Italy has just banned forms : of encryption on the phone system. The significance I think of the Three down, nine to go? (France has long since banned encryption) G

1 0

German "NSA" has a Clipper plan too? + News of German conf.
by Stanton McCandlish 17 Dec '03

17 Dec '03

More int'l. news of some interest. **** Begin Forwarded message **** From: Reiner Perivolaris <tutlaibe(a)w250zrz.zrz.TU-Berlin.DE> Message-Id: <9310082023.AA03362(a)w250zrz.zrz.TU-Berlin.DE> Subject: CCC'93 and You ... To: fig(a)well.sf.ca.us Date: Fri, 8 Oct 1993 13:23:34 -0700 Re-To: reiner(a)physik.tu-berlin.de X-Mailer: ELM [version 2.4 PL5] Content-Type: text Content-Length: 1827 The plan of the Clinton administration for the ISDN-Net (?!) will be a part of a workshop or a own theme and the fight for private cryptos (eg. PGP), include the trouble of P. Zimmerman. The 'Clipper/Skipjack'-Chip can/will be a theme, because storys are "on their way", that german BSI (*my* translation:Federal Office for Security of Informationsystems) and the TELEKOM (Telephoncompany) have a plan like the NSA. Where all this and more? At the CCC'93 (10. Chaos Communication Congress 1993). 27. -29. Dec. 1993 Eidelstedter Buergerhaus Alte Elbgaustr. 12 Hamburg-Eidelstedt Germany Organization: Choas Computer Club e.V. Address: CCC e.V. (Orga-CCC'93) Schwenckestr. 85 20255 Hamburg Germany I am one of the guys who organize this workshop and the congress. We are reading 'comp.org.eff.news', 'comp.org.eff.talk' and other information we can get. But only to talk about the EFF *we thing* is not enough. It would be nice, if members of Your organization will be there and have the chance to explain what EFF is doing. And when You get new members *we hope so* it will be good for Your movement and the 'global village'. **** End Forwarded Message **** -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp "A nation that is afraid to let its people judge the truth and falsehood of ideas in an open market is a nation that is afraid of its people." -JFK NitV-DC BBS 202-232-2715, Fido 1:109/? IndraNet 369:111/1, 14.4V32b 16.8ZyX

1 0

subscribe
by Gregory W. Kamen 17 Dec '03

17 Dec '03

subscribe

1 0

Russian LanCrypto info
by Mike Ingle 17 Dec '03

17 Dec '03

Here is some information about LanCrypto, a Russian public-key encryption program. This one sounds interesting. From: IN%"alex(a)crypto.msk.su" 20-OCT-1993 14:36:24.72 CRYPTO BANK System of programms of encryption (decryption) of files To work all users must have the files: afina.exe - programm for generation of new public and secret keys afinall.exe - programm for creation of a common list of public keys vesta.exe - programm for encryption/decryption of file NNNNN.pbl - file contains a new public key,NNNNN is a number of user secret.new - file contains a new secret key secret.key - file contains an old secret key FIRST stage. Generation of new secret and public keys by user User runs prigramm: afina.exe A message apears on the screen: Press any keys User begins to strike rand set of keys.A new secret key writes to floppy diskette A to file sekret.new. A public key writes to the current directory in the file NNNNNN.pbl (NNNNNN is a number of user). If you want to write your secret key on hard disk in current directory you run: afina.exe /k Then all users of sistem exchange their public keys(files NNNNNN.pbl.).We recommend thate users organise a CENTER .(The CENTER collects all public keys,creates a common list of public keys and sends it to users.) SECOND stage. Creation and sending a list of public keys. After exchanging of the files NNNNNN.pbl, user( CENTER ) has the files, received from his partners: N1.pbl N2.pbl ... NM.pbl To create common list of public keys , user( CENTER ) runs the programm afinall.exe . (dot in the end) if files * .pbl lokate in current directory afinall.exe [path] if files *.pbl lokate in other directory. Programm creates a common list and writes it to the file publall.key. THIRD stage. Encrypting of a file. If user number NNNNN encrypts file for user number LLLLL ,user number NNNNN runs : vesta.exe [path\]file_name LLLLLL [\k] (1) (\k is a parametre, the programm vesta.exe finds a secret key in a current directory, ;if you run vesta.exe [path\]file_name LLLLLL ,the programm vesta.exe finds a secret key in floppy diskette ) During the process of its work vesta.exe takes the secret key of user number NNNNN (from current directory(if you use \k) or from ffloppy diskette), takes the public key of user LLLLL (from file publall.key).Useing a secret key of user NNNNN and a public key of user LLLLL vesta.exe creats a common secret key.Then vesta.exe generates a rand session key,useing it and the comman secret key vesta.exe creats a secret session key and encrypts the file. The rand session key is not secret ant it is added to the file. FORTH stage. Decrypting of a file Encrypted file may be decrypted by two ways: 1. by user NNNNN, if he repeats programm (1); 2. by user LLLLL, if he runs : vesta.exe [path\]file_name NNNNN [\k] EXAMPLE 1 ( We have user 000(CENTER) and user 001): User 001 runs afina.exe \k.User 001 has files secret.new and 001.pbl in the current directory. User 001 sends 001.pbl to user 000(CENTR). User 000 runs afina.exe \k.User 000 has files secret.new and 000.pbl .User 000 receivs a file 001.pbl.He has: afinall.exe 000.pbl 001.pbl User 000 runs afinall.exe . (dot in the end ).He has: afinall.exe 000.pbl 001.pbl publall.key The file publall.key user 000(CENTER) sends to user 001. User 000 has : ! User 001 has : ! vesta.exe ! vesta.exe publall.key ! publall.key 000.pbl ! 001.pbl secret.key ! secret.key secret.new ! secret.new test0.txt User 000 encrypts file test.txt for user 001 .He runs : vesta.exe test0.txt 001 /k User 001 receivs test0.txt and decrypts it : vesta.exe test0.txt 000 /k User 001 encrypts file test1.txt for user 000.He runs : vesta.exe test.txt1 000 /k User 000 receivs test1.txt and decrypts it: vesta.exe test1.txt 001 /k SIGNING AND CHECKING OF ELECTRONIC MESSAGE To sign a message you must do: sign.exe file To check yoy must do: notary.exe file NOTALL.EXE makes men.cat(list of all public keys of signatures ) A F I N A PUBLIC KEY GENERATION SYSTEM AFINA is a unique package of programs for automatic generation of a common private key for a specific commynication session between two users. AFINA canbe used in any data transmission system with cryptographical protection. It rules out the need for a prior distribution of private keys to users. AFINA uses the best methods of public key generation between two users that have been tested and widely aookied by Western governments and commercial ventyres. Oyr original algorithm and programs have a four-fold increase in the speed of generating a public key compared to the best known standards while also improving data protection 100-fold. Having purchased the AFINA program, you will become fully independent of any key supplying service. AFINA automatically generates common private key for communication sessions with any user in several seconds. You can choose the key length. It will take two users less than 3 seconds to generate a common private key of 256 bits useng an AT 286 pc operating at 16 MHg. AFINA uses the disk operating system MS DOS 3.30 + and needs 32K of RAM memory. Any CGA, EGA or VGA graphic adapter can be used. A hard disk is desirable to speed up processing. Delivery: AFINA software on 5.25 DS/DD or installation by LAN-Ctypto. LAN-Cryoto provides guides and after-sales (warranty and post-warranty) service of the installed products as well as uodated versions and supplies them on favourable terms. V E S T A File encryption system VESTA is a package of programs providing the encryption of files on a user's disk. VESTA employs the most secure methods of cryptographic data protection such as the Data Encryption Standart (DES), a universally recognized system endrosed by Western goverments and commercial institutions, GOST 28147-89, national data encryption standards in computer networks as well as two LAN-Crypto algorithms for data encryption providing processing speed of 200 Kbyte/sec. on AT-286 (12 Mhz) PC. This is a record time for encryption programs. VESTA will allow you to assure your PC's data integrity, provide raw a "transparent" mode of exchange with a hard disk without delaying data processing. By choosing the appropriate VESTA encryption algorithm, you will be able to have secure exchange of information with most encryption programm users in this country and abroad. Encryption key input can be carried out both from magnetic mediums or keyboard. The number of keys of VESTA for cryptographic algorithms: 18 - DES 10 77 - GOST 28147-89 10 77 - VESTA 1 10 77 - VESTA 2 10 The low boundary of the encryption security is determined by the DES algoritm. For users of IBM PC , and compatibles, VESTA provides man-machine communicatin through the Disk Operating System MS DOS 3.30+. Program size of VESTA package: DES - 6 Kb GOST 28146-89 - 2 Kb VESTA 1 - 2 Kb VESTA 2 - 2 Kb VESTA provides friendly interface and detailed help. DELIVERY: VESTA software on 5.25 DS/DD or installation by LAN-Crypto, guides. LAN-Crypto provides after-sales (warranty and post-warranty) service of the installed products and information on updated versions of programms and makes them available on favourable terms. The extrended reference services. NOTARY SECURE ELECTRONIC SIGNATURE SYSTEM NOTARY is a system for generating electronic signature for PC files assuring their integrity and providing the ability to verify the identy of the author of the data auhor. You can use Notarius while storing information distributing floppy disks, or transmitting information throw public communication chanel. "Digital (electronic) signature" is a full analogue of a handwritten signature. The NOTARY " digital signature " employs two algorithms: one which produces the signature is kept secret, while the other, which verifies the identity of the author, is disseminated to recipients of of the signed documents. The NOTARY "digital signature" procedure employs the program "SIGNATUR" to "sign" a document file and creates a signature file which impossible to forge. The NOTARY checking programm analysizes the contents of document file and quickly and securely checks that the signature is authentic. NOTARY allows you to quickly and effectively introduce paperless processing into offices, local networks, banking systems, exchanges system, data communication networks, etc. NOTARY employs more advanced method of "electronic signature" than widely recognized RSA Digital Signature, which has been endorsed by commercial and goverment institotions in the United States. NOTARY's original algorithms and programm solutions allow the user to speed up the operation of signing documents four-fold compared with best known standarts. NOTARY employs the Disk Operating System MS DOS 3.30+ on IBM PC, and compatibles with the graphic adapter EGA (VGA). NOTARY needs 15 KB of RAM and offers a friendly interface and detalied help. Delivery: NOTARY software comes on 5.25 DS/DD or can be installed by "LAN Crypto", stuff we also provide documentation. "LAN Crytpo" provides warranty and post-warranty service of the installation products and information on updated versions of programs when avaiilable offers them on favourable terms to current users. Best regards. Alex Smirnov

1 0

Re: crypto technique
by hughes＠ah.com 17 Dec '03

17 Dec '03

I've looked at Matthew Ghio's encryption technique and have some comments. First let me summarize the system. private key: a sequence of polynomial functions f_1, f_2 ... f_n of the form a_i x (x+1)/2 + b_i, where a_i is odd. public key: the composition of these functions f(x) = f_1 ( f_2 ( ... f_n(x))) and a modulus P = 2^k plaintext: a value 't' ciphertext: the value u = f(t) decryption: finding t such that f(t)=u, by using of the f_i Matthew has repeatedly claimed that it can't be broken. Now one of the first rules of cipher design is don't claim that unless you have some good reason to believe that it can't be broken. Merely saying "I can't figure out how" is NOT sufficient. No flame intended, Matthew, this is probably the single most common failing of people interested in crypto. In particular, Matthew has made the claim that one must find the coefficients of the f_i in order to decrypt and claims that finding such coefficients is difficult. He calls this operation factoring; properly speaking this is a 'decomposition', since the operation used to make f(x) is not multiplication by composition (called iteration when all the functions are the same). As I suspected and Karl has demonstrated, these decompositions are not unique. Since the plaintext, ciphertext pair does not depend on the representation of the function, only upon the coefficients of the polynomial function which is the public key, any such decomposition will suffice for decryption. In other words, you don't have to find how the function was created in order to decode. All you need is some way of inverting the polynomial function f(x). Note that I am using the phrase polynomial function here, and not just the word polynomial. There is a big difference. Polynomial functions are real functions with a domain and range. Polynomials are elements of a ring created by adjoining an indeterminate 'x' to some ring. Polynomials can be 'evaluated' as polynomial functions under some circumstances, but not always. A side note. The function Matthew picks, 1/2 x(x+1) is not, properly speaking, a function with coefficients in Z/2^k (integers mod 2^k). It is, however, a coefficient in Z/2^{k+1} There's one significant difference for the purposes of this proposed cipher: polynomials have arbitrarily large degree, but every polynomial function over a finite ring (such as integers mod N) is equal to some polynomial function of finite degree. One can see this easily be recalling Fermat's little theorem a^N == a (mod N). Thus x^N == x (mod N) for polynomial functions, which limits the degree. Matthew has proposed that arbitrarily many compositions will give a function which can't be inverted. This is certainly not the case if N = 2^k as he proposes. The following relation holds for all integers n > 0 and for all integers t: 2^{2^n - 1} | \Product_{i=0}^{2^n - 1} ( t + i ) What this means is that as the 2^k grows larger, the maximum degree of the polynomial functions grows as 'k', not as 2^k. In other words, the degree grows as the logarithm of the modulus, or linearly in the number of bits in the modulus, if you prefer. This is certainly not a good sign. Recommendation: don't use N=2^k. It's a general rule of cryptosystems that if you use 2^k moduli to speed your encryption, you will also speed the attack, and not just from increased speed, but from algebraic properties of these moduli. There have been some spectacular failures in this regard, notably a chip which was built to do modular exponention for a particular 2^k which was later found to be totally insecure. Another property which decreases the security of the scheme is that polynomials over Z/2^k don't have unique factorization. Therefore the polynomial functions don't have unique representations. For example (x+1)(x+3) = (x+5)(x+7) (mod 8) (x+2)(x+4) = x (x+6) (mod 8) x (x+1)(x+2)(x+3) = 0 (mod 8) (from the expression above) This makes it all the easier to invert the polynomial. The reason that you don't have unique factorization is that Z/2^k has zero divisors: 2 x 4 = 0 (mod 8), so two divides zero. The presence of zero divisors means that you don't get unique factorization. There is, however, a twist. If you don't even see the zero-divisors, you can pretend they aren't there. This is exactly what RSA does, since if you find a multiple of one of the factors of the modulus, you've broken the system. But if you use a modulus of the form pq, you're basically using RSA! RSA picks a particularly easy polynomial function to invert, namely f(x) = x^e. Other polynomials would work as well, and, in fact, appear in the patent application, albeit without examples. Now if you pick a prime modulus, you don't have a public key system anymore. This is the Hellman-Pohlig patent, which uses x^e (mod p) as its encryption. In this scheme 'p' is kept secret, since otherwise the exponentiation could be reversed. In short, I don't think Matthew's scheme can be made to work. There is an open question about how the base field increases with each composition because of the presence of the 1/2, but I don't think currently that this makes it work. For a specific reference, see the collection _Cryptology and Computational Number Theory_ which contains an essay by Kevin McCurley "Odds and Ends from Computational Number Theory." Section 3 of this essay discusses the breaking of some similar schemes by some non-obvious means. I quote: "Moreover, it holds a valuable lesson for those who tend to believe that a computational problem is difficult just because the only apparent solution is difficult." Eric

1 0