- cypherpunks-legacy - lists.cpunks.org

Total RSA in PGP
by Network Demon 29 Aug '93

29 Aug '93

Is it possible to use RSA all the way through a PGP encrypted message (do not use IDEA)? If so, how? I know it would take a LONG time, but it would make for a nice option. If not, why? Although, it might take "forever", why not make it an option for those willing to wait? Am I mistaken in believing RSA is more secure than the present hybrid? Thanx, --demon

2 1

Re: Commercial PGP; trapdoor rumors
by an31185＠anon.penet.fi 28 Aug '93

28 Aug '93

In message <01H2813M8J6090MZGB(a)delphi.com> Mike Ingle said: >If there is any flaw in PGP, there are only a few places where it >could be. The basic mechanics of the program (RSA, IDEA, etc) obviously >work. I'll agree with you there, or at the least, if they don't work I'm not likely to be able to prove it. I also very much doubt that there's really a 'trapdoor' to deliberately make decryption easy, but there's plenty of scope for a bug or unwarranted assumption to do so by accident. (Look at WordPerfect 5.1 encryption, for a good example). >The file format can easily be checked to make sure it is correct. >A subtle flaw would have to be somewhere like: prime number generation, >random RSA key generation, or random session key generation. If the primes >weren't actually prime, that would make the RSA keys breakable. But >you could take the primes (pgp -kg -l and you will see them in hex) >and feed them into a primality tester to verify that. With regard to the file format, I've just been looking at that, I hacked a test copy of PGP 2.3a to dump out the plaintext that it would normally idea-encrypt to a file, and encrypted a selection of files with a selection of keys to look for known plaintext, then went back into the source code to track down where it came from. The first twelve bytes of the data that gets idea-encrypted contain two bytes of known plaintext, and two repeated bytes. The actual contents are: bytes 1-8: Randomly generated prefix bytes 9-10: Repeat of bytes 7 and 8 (key check bytes) bytes 11-12: ALWAYS 0xA3 and 0x01 !!!! The repeated bytes come from idea_file() in crypto.c, and are used to verify that you got the correct key to decrypt the file. The known bytes come from squish_and_idea_file() in the same file, and verify that the input contains compressed data and that it's zipped. Now, I don't know enough about idea encryption to know how much this would help to break the code, but it still seems to me that much of this does not need to be here. Anyone got any suggestions ? (I'd guess you could at least move the repeated bytes to the end of the file ?). It's definitely a weak point, as a brute-force attack would only need to decrypt 12 bytes to verify (or almost verify ?) a correct idea key, though whether that *greatly* reduces the security, I don't know. I realise that the random bytes are supposed in part to protect you from this, however, I don't see any point in reducing the security of the data if you don't have to. >The most likely place for a bug would be in the randomness. I suppose >it is possible that a one-line bug somewhere could leave out most of >the randomness, making the keys still look random but actually be >predictable. Random number generation is hard to verify. How has >that in PGP been checked? The PGP source is so big and spread out, >it's hard to check. I don't think there is a bug, but it would >be nice if PGP were carefully examined and attacked. Where are these >rumors coming from? They are bad for the cause. Randomness is the next thing I'm going to look at. From the output I've produced, I can't say I'm greatly impressed by the randomness of the random prefix bytes, though that's probably a result of looking at such a small sample. Tomorrow, hopefully, I'll set a program running to generate a few hundred thousand PGP random numbers and look at what comes out. Obviously, I can look at the frequency of different byte values, both overall and in each of the bytes it produces, but does anyone know of any other simple 'randomness' tests for 16-byte random numbers ? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

USENET and US-legal PGP (signing only?)
by Clifford A Adams 28 Aug '93

28 Aug '93

Hello again! Has there been any progress on a USA-legal PGP? Are negotiations still in progress or are they stalled? I am willing to write code (up to a few thousand lines of C) to help integrate PGP with USENET newsreaders. (I have a little PGP/RIPEM signature verification fuction now, and a section called "Digital signatures, cryptograpy, and USENET" in the online documentation.) I am waiting for a US-legal version of PGP before coding further. I think that USENET provides a wonderful environment for public key crypto applications. My particular interest is in digital signatures for forgery protection. One use of this is in collaborative message filters where people can rate or add keywords to other messages. I would like for all of this to be updated semi-automagically, using usual (insecure!) USENET postings. Greater numbers of strong-crypto users should also help in the political arena. Many people don't see why the current cryptograpy battles are important, because they don't care very much about strong privacy. An easy-to-use cryptosystem integrated into their ordinary tools like newsreaders and mailers will get some of these people involved. For instance, imagine these interactions: ----- start examples ----- [While reading news, the user types 'r' to reply to a message] The poster included a PGP encryption key, and will accept encrypted replies. Encrypt your reply? [nyh] === [User posts a message] PGP key found. Sign this posting? [yn] [User types 'y'] Signing posting using PGP key. Enter your passphrase: [...] === [User posts a message] Digital signature not found. Would you like to generate a digital signature? (type 'h' for help) [nyh] [user types 'h'] A digital signature allows other people to have some confidence that your postings are really from you, and not a forgery. ...[more explanation of digital signatures, about 10-15 lines]... Generating a digital signature usually takes between 5-15 minutes. You will only have to do this once. Would you like to generate a digital signature? (type 'h' for help) [nyh] [user types y] PGP found. RIPEM not found. Generating digital signature using PGP... [Nice, friendly key generation process.] ----- end examples ----- Finally, would it be possible to release a US-legal/RSAREF *subset* of PGP which allows only signatures and signature verification? To my knowledge this wouldn't require violating the RSAREF interface. (My understanding is that the interface problem is that PGP uses IDEA rather than DES for message encryption. The signature is simply an RSA-encrypted hash of the message--this could be handled by the RSAREF package. Correct?) --Cliff -- Clifford A. Adams caadams(a)polaris.unm.edu | USENET Interface Project: 457 Ash St. NE Albuquerque, NM 87106 | Tools for advanced newsreading STRN (Scan TRN) now in testing: trn 3.3 plus flexible newsgroup menus, fast article scoring with score ordered display, and merged/virtual newsgroups.

1 0

Re: Another BBS Seizure in Hartford
by George A. Gleason 28 Aug '93

28 Aug '93

Bombs & bulletin boards: the news media regularly mention the name of the chemical used to stinkbomb abortion clinics, and the composition of the world trade center bomb. So it seems to me a decent defense could be made on the grounds of "selective prosecution" since after all, juveniles can always tune in the news and learn how to make bad things. Well...? -gg

2 1

differential cryptanalysis
by Timothy Newsham 28 Aug '93

28 Aug '93

Hi, Does anyone have code that implements differential cryptanalysis of DES like systems? I'd be most interested in seeing something that will find the key of a DES system with less than 16 rounds. Tim

1 0

Only Pretty Good
by an31144＠anon.penet.fi 28 Aug '93

28 Aug '93

>> Derek Atkins Said: > Secondly, regarding "whom do you trust": Do you trust Phil Z? As far > as I know (and granted, its not much, yet), Phil Z is going to oversee > the commercial product, to make sure that nothing is put into it. >>>> If Phil says that the commercial PGP is OK, I will believe him. >>>> Dan Odom It's worth re-reading the PGP docs again to re-establish the fact that _Phil_ only rated PGP as Pretty Good Privacy. I trust that appraisal and believe it to be accurate. I do not expect that the commercial product will be appreciably better or worse.

1 0

Another BBS Seizure in Ha
by Duncan Frissell 28 Aug '93

28 Aug '93

To: cypherpunks(a)toad.com PLEASE CROSS POST AT WILL R >The Hartford Courant on August 5, 1993 (page b-4) stated that a 21 R >year old computer BBS operator was arrested for maintaining a computer R >bulletin board that had a bomb making recipe. R > R >Michael Elansky was charged by the West Hartford police with inciting R >injury to persons or property - a felony charge - and risk of injury R >to a minor. R > R >He was held in lieu of $500,000 bond (in CT the bond for a person R >accused of murder is normally $100,000) I just spoke to his mother Elaine and Michael himself from jail via the miracle of call waiting. She is establsihing a defense fund. Please send money: Michael Elansky Defense Fund P. O. Box West Hartford, Connecticut 06117 Duncan Frissell --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

1 0

Another BBS Seizure in Ha
by Duncan Frissell 28 Aug '93

28 Aug '93

To: cypherpunks(a)toad.com Please crosspost --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

1 0

AT&T Home Security Plus
by George A. Gleason 28 Aug '93

28 Aug '93

Today I got a most interesting call from a phone solicitor, who said that he was with AT&T and they were going to be hosting a demo of an AT&T home security system on my block and was I interested in attending. I told him about Clipper and asked if the AT&T home burglar alarms came along with backdoors allowing various govt agents and burglars to sneak in. Somehow the discussion shifts to PGP vs. Clipper, and the caller asks if I've got a handle (I told him my email address, which was Really Dumb) and then he asks if I'm into pirating or anything... of course I'm not, and said so.... Somewhere along the line I entirely forgot to ask how the hell he got any idea what block I lived on, since my residence address information is something I take great pains to protect. And then it occurred to me... perhaps Something Else is also going on...? Like, "are you into pirating...?" Hmmm... I never even thought about that at the time, but if anyone else out there gets a call like this, it might be worth some follow-up research... -gg

2 1

Internet: commercial or n
by Duncan Frissell 28 Aug '93

28 Aug '93

To: cypherpunks(a)toad.com L.>In the current situation, all the government bureacrats fire off L.>messages that `even though your message can travel on commercial nets L.>only, there is no way of guaranteeing that it does not cross public L.>networks, therefore it must abide by NSF Internet Use Policies.' To which I fire back: "Since you consider it OK for Internet to carry pictures of naked men, women, children, and animals as well as text (tiny) sex and such kink as alt.fan.bill.gates, you have to put up with *our* ideas of the sorts of activities that consenting adults can engage in online. I'm sick and tired of this discrimination against commercial intercourse." Duncan Frissell Who practices commercial activities every day on the Internet and is not ashamed to admit it. --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

1 0