‚‚‚‚Assymetic crypto systems such as Diffie-Hellman, El-Gamel, and DSS, allow the private key to be a randomly chosen number. ‚But, as a cute hack, instead of using a random number, for the private key, you could use a hash of the User Name, and a password.

That has been proposed in the context of elliptic curve cryptography where the keys don't need much entropy. I think George Barwood's pegwit works that way. I don't like the idea though. You're giving everybody the chance to run a password guessing attack on your secret key.

-- James Donald's "Crypto Kong" system http://catalog.com/jamesd/Kong/ does this. It uses Diffie-Hellman and ElGamal crypto over Elliptic Curves, so it can get away with relatively short keys, 240-255 bits. The secret key is hashed from your passphrase (and/or a keyfile*) Your public key is generated from the secret key and a generator. Because the public keys can be short, there are some real conveniences. You don't need to distribute big clunky keys in a keyserver; 255 bits is just 43 characters of base-64, so you can put it in your mail signatures and on your business cards. Kong takes an interesting approach to key certification and signatures - it doesn't use the "True Name" model with a Certificate Authority Trusted Third Party Subject To Many Government Regulations certifying that the person who has this key has that True Name. Instead, you sign messages, and it keeps a database of signed messages from people, and you can compare a message you have with a message you've received previously to see if it's signed by the same key, and you can send encrypted messages to the person who sent you a previous message. If you want to do the equivalent of signing a key, you just sign a message including someone else's message, maybe adding commentary (which is hard to do in PGP.) Here's an example: -- 2 Dear Carol I've known Bob for a long time, and he's probably not an FBI plant. Here's a copy of his business card. Alice -- Bob Dobbs, Sales, PO Box 140306, Dallas TX 75214 http://subgenius.com/bigfist/pics2/logoart/dobbs3x45.GIF --digsig Bob F9KBGIfyizpoyo8i8NS/Dqe/eP4WVNcXcRJuS14QPXn N9Cm/pDw8sgVDMj8f3upNmp1pSE3rSj0atQuF7Jt 4RgxEDpUxK1DVzBejpH3qqvrqcY2+8M+pSXFB0LLG --digsig Alice 9Xjp1N+QDtXR9Mw1S0gJTnwliGM3rQpuzdogeqOLqii ckd5NlB2nGrQHe4TSMSDd791WEq64XCotsYG0oiZ 4W3Yi4QBCgYC0SnORJFesTOcbCsmGsEnXZRCVrsou and you can go compare Alice's signature with the one she gave you at the Prop 215 Bake Sale. On the other hand, "work on another computer" is a dangerous phrase. If it's another of _your_ computers, fine, but otherwise how do you trust that the copy of Kong or PGP or whatever you're running is the real thing, or that it's not saving your passphrase from the keyboard driver, or all the usual threats. Those threats are somewhat true with your own computer, but there you not only have some control over the machine, you know that if Bad Guys have cracked it, your data is hosed anyway :-) [ * The Kong keyfile of might-as-well-be-random bits which gives you entropy, and makes the system usable in environments where passphrases aren't convenient, such as unattended batch mail decryption done in remailers. You can either use just the passphrase, use just the keyfile, or use both.] At 01:53 PM 10/27/98 -0800, RedRook <redrook@yahoo.com> wrote, approximately,

Asymmetric crypto systems such as Diffie-Hellman, El-Gamal, and DSS, allow the private key to be a randomly chosen number. But, as a cute hack, instead of using a random number, for the private key, you could use a hash of the User Name, and a password.

Doing so allows the users to generate their private key on demand. They don't have to store the private key, and if they want to work on another computer, they don't need to bring along a copy. Has any one tried this? Is there existing software that does this? Any comments on the security of such a scheme? The only draw back that I can think of is the potential lack of randomness in the key.

--digsig Bill Stewart <bill.stewart@pobox.com> 3k3eg3jOiy57hhibcg9SkKVwkCUw7ivtVjJBm2E0WIC 1IidMTkWR0QwVsOPeyEgQ7wdKKVtka99jziuLfOs 4VIpwv6kNvAPJdk49JEtprvCnxTBrNSyViHqgxqGc

At 4:20 PM -0500 10/29/98, Adam Back wrote:

Some people have been talking about using passwords as private keys. (By using the passphrase as seed material for regenerating the private and public key).

I don't think this is a good idea.

You can't forget passphrases. You can destroy private key files.

Yes, you can. I had an art director forget his 4 days running, AFTER LUNCH. He remembered it in the morning, but after lunch he couldn't. It wasn't a "passphrase" either, it was a _very_ weak password. -- "To sum up: The entire structure of antitrust statutes in this country is a jumble of economic irrationality and ignorance. It is a product: (a) of a gross misinterpretation of history, and (b) of rather naïve, and certainly unrealistic, economic theories." Alan Greenspan, "Anti-trust" http://www.ecosystems.net/mgering/antitrust.html Petro::E-Commerce Adminstrator::Playboy Ent. Inc.::petro@playboy.com