"h" == hallam <hallam@w3.org> writes: h> There is some work by Phil Rogaway on making keyed digest h> functions which I strongly recommend people look at. I can post a h> paper on the subject if people are interested. There's also ``Message Authentication with MD5'' by Burt Kaliski and matt Robshaw in RSA Laboratries' CryptoBytes, http://www.rsa.com/rsalabs/cryptobytes/spring95/md5.htm, michael

hallam@w3.org writes:

Do not spec Keyed MD5, it is a complete looser. It is actually weak against a number of attacks. There are much better constructs for creating a keyed digest. There are much better ways of creating a digest than using a hash fuinction as the base.

What??? A keyed version of MD5 is the base authentication mechanism in IPSP and it has been heavily examined by a number of very good cryptographers. Perry

hallam@w3.org writes:

...

A keyed version of MD5 is the base authentication mechanism in IPSP and it has been heavily examined by a number of very good cryptographers.

Yes we reviewed it and said that it sucked.

Phil wrote a note to Ron and Ron sent in a series of comments.

Phil was complaining largely because in spite of his apparent cryptography credentials he's a lughead who can't have been bothered to understand the architecture -- most of his comments reflected a general ignorance of the process and of the discussions that had preceeded. He also complained that the transforms weren't sufficiently generic for his tastes. However, no complaints AT ALL were made about Hugo's selection of cryptographic transform. We were assured by everyone that it was the right thing to do, with people swearing up and down that it was the appropriate idea. Do you want me to extract the mailing list archives? Every last posting on this topic is on line.

The sequence of events I heard was that they asked Burt Kaliski for a suggestion, he gave them one and they chose something different.

Actually, Kaliski made an off-the-cuff suggestion that all the other crypto folks ripped apart, largely because it was obvious even to me how it could be attacked, and then he backed off. Perry

Since you deal with security issues maybe you can help me to learn about some issues with encryption. I am talking with one of the administration people about putting PGP on the system for everyone to use, but there are issues for them (the admin) as they might be liable, even if they can't read the e-mail. What other legal considerations should be evaluated? Is there any large organizations (like any other universities) that allow their students to use PGP, and have the system in place to make it easier for the students? If it is offered here I might be the one to add to the mail program (pine) that is generally used to transparently use PGP, which is what I mean by having a system set up for the encryption. Thanx for any help. Take care and have fun.

James Black black@suntan.eng.usf.edu

We have approx 1000 machines and 5000 user accounts and have pgp installed. I can't think of any reason not to have it installed, and lots of good reasons for having it installed. -- ____________________________________________________________________________ Doug Hughes Engineering Network Services System/Net Admin Auburn University doug@eng.auburn.edu Apple T-shirt on Win95 - "Been there, done that"

Hello, On Mon, 30 Oct 1995, Rich Graves wrote:

On Mon, 30 Oct 1995, Doug Hughes wrote:

I would think that you would worry more about your users getting a false sense of security from storing secret keys on a large multiuser system than about being held liable for naughty PGP-encrypted traffic. I don't see how you could be held liable anyway. How is PGP that much different from allowing your users to set a password on their account? It makes it harder for root to invade their privacy, but in general, we have very stringent requirements that must be satisfied before we'll read user directories or mail.

As a student I am concerned with the false security, and that was mentioned while we were talking (today). As to liability, it is important that no one can come back and hold the school liable. Once the messages can be encrypted then it is harder to read the messages, but not impossible, unless the students keep the key on a disk, and just ftp it into the account everytime. The fact is that that won't be the rule, so the admin can still read messages, but there will need to be clear-cut reasons for them to do that (IMOHO). I am curious what requirements must be met. I guess there are more schools that allow this than I expected <g>. Well thanx for replying. Take care and have fun. James Black black@suntan.eng.usf.edu

One important thing to note in an academic environment is that if you have foreign students who are on non-green card visas, you may need to get an export licence if they can access the server. I expect you'll probably get the licence without too much hassle, and you're unlikely to be indicted for this, but it's something to be aware of. Simon ---- (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))