HDTenEightyP/NetNews huggingface dataset:
From: pcl@ox.ac.uk (Paul C Leyland)
Newsgroups: sci.crypt
Subject: Re: KH-11 pictures -
Date: 11 Jan 93 10:39:26 GMT
	<9301081644.AA19208@TIS.COM> <1993Jan9.000917.22206@qualcomm.com>
Organization: Oxford University Computing Services, 13 Banbury Rd Oxford OX2
	6NN
In-reply-to: karn@servo.qualcomm.com's message of 9 Jan 93 00:09:17 GMT

In article <1993Jan9.000917.22206@qualcomm.com> karn@servo.qualcomm.com (Phil Karn) writes:

   In article <9301081644.AA19208@TIS.COM> mjr@TIS.COM writes:
   >	Those pictures were from a KH-11. KH-11's are presumably
   >quite obsolete. We're talking a matter of years since those pictures
   >were published. If you extrapolate a little bit, based on the kinds
   >of advances in commercial electronic imaging that we've been seeing,
   >it's quite possible that far, far higher resolution pictures are
   >possible.

   You forget about the diffraction limit.  What I found so interesting
   about those pictures was that their resolution (30cm) was just about
   exactly what I'd expect for an objective mirror just small enough to
   fit in the payload shroud of a Titan 3C, operating at visible light
   wavelengths from minimum orbital altitude.  I.e., the KH-11 is already
   operating damn close to the theoretical limits. It's simply not
   possible to do better without getting closer and/or using a larger
   mirror. The laws of physics are the same for classified projects as
   they are for the rest of us.

Actually, *if* your data are good enough (that is, if the signal to
noise ratio is large enough) and *if* you can model the blurring
function well enough, you can do arbitrarily better than the
diffraction limit.  I agree with the statement about the laws of
physics though 8-)

Take a look at some of the papers on the Maximum Entropy Method for
some nice examples.  For instance, some very sparse data (and fairly
noisy -- the data were all smaller than 200 counts if memory is
correct) from an X-ray telescope was deconvolved to show the double
nature of the source.  The processed image was far better than the
original.  Sorry I can't post references just now -- my re-prints are
at home.


Paul
--
Paul Leyland <pcl@oxford.ac.uk>          | Hanging on in quiet desperation is
Oxford University Computing Service      |     the English way.
13 Banbury Road, Oxford, OX2 6NN, UK     | The time is come, the song is over.
Tel: +44-865-273200  Fax: +44-865-273275 | Thought I'd something more to say.
Finger pcl@black.ox.ac.uk for PGP key    |
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 8 Jan 1993 01:37:26 GMT


Arthur Rubin posts a factually incorrect message echoing Perry
Metzger's assertion that I'm the only one with my position on
ITAR.

I have the e-mail to prove otherwise.

It's a common propaganda technique to try to squelch those with whom
one disagrees by pretending they are somehow alone in their views,
with the implication that "normal" people wouldn't have such views.

Though Metzger's oft-announced extreme political views makes his
post unsurprising, from what I know of Rubin he should know better.

David

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

From: Stu@f729.n153.z1.ship.wimsey.bc.ca (Stu)
Sender: UUCP@ship.wimsey.bc.ca
Newsgroups: sci.crypt
Subject: Limits on the Use of Cryptography?
Date: Mon, 04 Jan 1993 02:53:33 -0800

JH> This raises an interesting question. If the government tosses me in
JH> jail for refusing to relinquish my private key as required by law,
JH> it will likely get access to my UNIX account and all the files
JH> contained
JH> thereon. My private key is protected by a password, and PGP demands
JH> it each time I attempt to use it. Just how secure is PGP's encryption
JH> of secret keys?

The security of PGP's key encryption alogorithm is, as it should be, only as
strong as it's key.  While an 8 byte alphanumeric password is hardly as secure
as they 1024 bit key it protects, it would keep one busy for a little while
trying to break it..

Assuming an 8 letter password, and say about 70 choices for each letter ( 26
uppercase, 26 lowercase - yes it's case sensitive - 10 for numbers + some
punctuation etc ) hmm... 70^8 is...   5.765*10^14.  So the spooks that are
tailing you would have to try that many passwords.  Judging from PGP's spew
"Pass Phrase *looks* good."  I'd guess there's some way of telling if the pass
phrase works or not without actually having to uncipher the key and then say,
see if it is the multiplicitive inverse of the public key.

(wow, all these numbers are getting me excited - let's see what else I can
figure out..)   Let's say you borrowed Mr. Diffie's million-key/sec DES
cracker and modified it for these purposes..  it would take 5.765*10^8
seconds, or about 18 years - that seems awfully secure for a simple
password... if I boo boo'd, let me know..

Newsgroups: sci.crypt
From: dorsey@lila.com (Bill Dorsey)
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Organization: Information Systems Corporation, Palo Alto, CA
Date: Fri, 8 Jan 1993 09:45:18 GMT

In article <1993Jan8.013726.3503@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>
>Arthur Rubin posts a factually incorrect message echoing Perry
>Metzger's assertion that I'm the only one with my position on
>ITAR.
>
>I have the e-mail to prove otherwise.
>
Your views are clearly in the minority -- at least in this group.  Not
only that, I think everyone is sick and tired of hearing them over and
over like a broken record.

>It's a common propaganda technique to try to squelch those with whom
>one disagrees by pretending they are somehow alone in their views,
>with the implication that "normal" people wouldn't have such views.
>
It's a common propoganda technique to try to squelch those with whom
one disagrees by claiming that their attacks on you are common propoganda.

>Though Metzger's oft-announced extreme political views makes his
>post unsurprising, from what I know of Rubin he should know better.
>
You're the one with the extreme political views -- at least in relation
to the readership of this group.  And you're generating an awful lot of
hostility by asserting the validity of your own views over those of
others.  You are so effective at doing this that you have almost single-
handedly managed to lower the signal-to-noise ratio here to the point
that a lot of people are unsubscribing.

In the last 20 days, David Sternlight has managed to post 71 articles
to sci.crypt.  That's more than 3 1/2 per day.  It wasn't long ago when
sci.crypt only contained about 3-4 messages per day.  In comparison,
Perry Metzger and Arthur Rubin have posted 10 and 25 messages in the
last 20 days respectively.  I doubt I could find another poster to
sci.crypt that has posted even half as many articles as David Sternlight
has in the past 20 days.  And I doubt I could find more than a couple of
instances of an article posted by David Sternlight in the past 20 days
that contains anything other than political and ethical ramblings which
I assert the vast majority of the readers of this group would prefer not
to read.

-- 
Bill Dorsey      "Most people mistake law for justice and authority for
dorsey@lila.com   liberty.  You will hear them talk of 'liberty under law,'
PGP 2.x public    and they are content to see it so deep under the law that
key on request    it is completely obliterated." -- Herbert Spencer
From: cepek@vixvax.mgi.com
Newsgroups: sci.crypt
Subject: Re: Any way to CREATE Vcr+ codes?
Date: 6 Jan 93 14:47:42 CDT
Organization: Management Graphics, Inc.

In article <29287@oasys.dt.navy.mil>, curt@kcwc.com (Curt Welch) writes:
> I'm one of the people the "broke" the codes.  It isn't that simple.
:
> The algorithm was created by many, many hours of research.  
:
> You don't have to collect published codes, you can just sit down with the
> VCR Plus+ device and start punching in numbers.  But there are 9,999,999
> 7 digit codes (and each one requires 9 button presses to test), so it can
> take a long time to get enough numbers.
> 
> This is at least part of why we stopped working on the codes.  It was
> taking too much time.

OK, let's see.  Break out the old, klunky hot-box computer.  Warm up 
the solder gun.  Use an I/O port to "press" the buttons on the unit, and
read the output with a(n infrared?) detector.  Push RUN, let it go for
awhile, and then look at the gathered data.  It may not be trivially
easy (the funnest things often aren't), but it doesn't have to be slow. 
Just a-dreamin'...
From: br197@cleveland.Freenet.Edu (Michael T. Gercevich)
Newsgroups: sci.crypt
Subject: Lotus Password Decryptor?
Date: 12 Jan 93 13:55:53 GMT
Reply-To: br197@cleveland.Freenet.Edu (Michael T. Gercevich)
Organization: Case Western Reserve University, Cleveland, OH (USA)
NNTP-Posting-Host: slc10.ins.cwru.edu


I'm sure it's been done, right?  We have an employee that left our firm
and need access to the Lotus 1-2-3 spreadsheet on his PC.  Of course they
are password protected.

Anyone know the encoding used on .WK1 and .WK3 files... or better yet
have a decypher?

Thanks in advance...

-- 
Michael Gercevich  --  PC/Network Analyst  --  Squire, Sanders & Dempsey

INTERNET ==> br197@cleveland.freenet.edu
X.400    ==> /PN=MIKE.T.GERCEVICH/O=SSD/ADMD=TELEMAIL/C=US/@sprint.com
Newsgroups: sci.crypt
From: ctdonath@mothra.syr.EDU (Carl T. Donath)
Subject: Re: sci.crypt.science
In-reply-to: Andrew Cadach's message of Fri, 25 Dec 1992 17:19:21 GMT
Organization: Syracuse University
Date: Mon, 4 Jan 93 11:11:54 EST

How about talk.politics.crypto? rec.guns has its political counterpart
talk.politics.guns, so why not do the same thing here? That would also
put it in an appropriate hierarchy (sci.*.* isn't).
--
______________/ ctdonath@rodan.acs.syr.edu \______________________________
Most people agree that the government is largely sluggish and ineffective.
Then why do most people demand that it do everything for them?
--------------------------------------------------------------------------
From: jim@rand.org (Jim Gillogly)
Newsgroups: sci.crypt
Subject: Re: Here's a challenge
Date: 11 Jan 93 06:20:50 GMT
Organization: Banzai Institute

In article <1993Jan11.021259.10637jp@tygra.Michigan.COM> jp@tygra.Michigan.COM (John Palmer) writes:
>I want to check out some components of an encryption system that I'm
>using and would like to see if anyone can crack this encrypted file.
>Only hint is that its text of some kind. I've uuencoded it. 
>
>Palmer
>
>begin 600 text.crypt
>M]:R<BHR>T]^;FHF:WXV6G)>6FIN:C9K?EI/?G)J-BY:9EIR>BY#?EI&,G(V6
...
><BHV0G(V>A9:>WM^^C8V6B9J;FHV<EM'?]?7U]9K1

I always wonder about posting decryptions of stuff I can't read, but here it
is anyway.  Sorry, my Italian's not good enough to tune the rest of the
punctuation...

  |Scusal deve richiedere il certificato inscrizione alguniverita|
  |Perche  cose le serve il certificato|
  |Per rinviare di un annol il servizio militare|
  |Deve presentare il domano scritta su un foglio di carta bollata|
  |He askes "When can I pick it up."|
  |Alla fine del mese||Ma scusal perche  cose tardi. Non capisco proprion|
  |In questo periodol abbiamo molto lavoro da svolgere e  molte pratiche di
  |finire|
  |Capiscon Non c e niente da faren E  la solita burocraziaa Arrivedercin |
  |||

I arbitrarily assigned the | to some kind of separator... seems to set off
separate utterances in a conversation.

Hope this answers your question about the security of that particular
component. :)

-- 
	Jim Gillogly
	Highday, 20 Afteryule S.R. 1993, 06:20
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Key Length (was Re: Limits on the Use of Cryptography?)
Date: 5 Jan 1993 23:11:23 GMT
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com

In article <726201680.AA00090@ship.wimsey.bc.ca> Stu@f729.n153.z1.ship.wimsey.bc.ca (Stu) writes:
>Assuming an 8 letter password, and say about 70 choices for each letter ( 26
>uppercase, 26 lowercase - yes it's case sensitive - 10 for numbers + some
>punctuation etc ) hmm... 70^8 is...   5.765*10^14.  So the spooks that are
>tailing you would have to try that many passwords.

This calculation has a problem.  It assumes that each 8-letter password
is equally likely...so that a person would use "1pJ1NpxM" as readily as
"BillyJoe".  The only way I know to do that is to have a program assign
passwords and allow no choice by the user.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
Newsgroups: sci.crypt
From: ggm@brolga.cc.uq.oz.au (George Michaelson)
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Organization: Prentice Centre, University of Queensland
Date: Wed, 6 Jan 1993 06:32:45 GMT

[to the authors/owners of this ftpable s/w]

You could make life a LOT simpler for everybody who wants to be "honest"
(read whatever you like into that.) by putting the "USA only" clause up
the top of the README...

	-George
--
                         George Michaelson
G.Michaelson@cc.uq.oz.au The Prentice Centre      | There's no  market for
                         University of Queensland | hippos in Philadelphia
Phone: +61 7 365 4079    QLD Australia 4072       |          -Bertold Brecht
Newsgroups: sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: Complete ITAR Available
Reply-To: karn@chicago.qualcomm.com
Organization: Qualcomm, Inc
Date: Mon, 11 Jan 1993 20:41:20 GMT

I note that what I received is actually the text of a *proposed* set
of ITARs. Chances are they were adopted pretty much as written, but I
would like to know for sure.

If these rules are in fact now current, I think the argument may be
all but over. In the past, the problem has been whether the ITAR
definition of "technical data" included "software". There has long
been an exemption for "technical data" that is "in the public domain",
but it was argued (specifically by a DEC attorney a few years ago)
that "software" was a "defense article", not "technical data" and thus
did not qualify for the exemption. *All* of our problems with public
domain crypto software came from this basic interpretation that
software was not "technical data".

However, these new rules now seem to explicitly include "software" in
the definition of "technical data". And since the public domain
exemption is still there, it is possible that there is no longer *any*
problem with exporting public domain crypto software.

Of course, the right thing to do is to run all this past an attorney
and verify it. --Phil


Sec. 120.23 Technical data.
    Technical data means, for purposes of this subchapter:

	[...]
    (c)  *Software* as defined in Sec. 121.8(f) directly related to defense
articles;

	[ I can't find Sec 121.8(f). Can anybody look up this specific
definition?]

	[...]
125.9  Filing  of  licenses  for  exports  of classified technical data and
classified defense articles.

	[...]

    (a)  The  export controls of this part apply to the export of technical
data and the export of classified defense articles. Information which is in
the  ''*public* domain'' (see Secs. 120.19 and 125.4(b)(13)) is not subject
to the controls of this subchapter.


[I've deleted the lengthy definition of "public domain" since it is
clear to me that anything up for anonymous FTP clearly qualifies.]




Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Primitive Polynomials (Mod 2)
Keywords: Primitive Polynomials (Mod 2)
Organization: Chinet - Public Access UNIX
Date: Fri, 8 Jan 1993 18:56:52 GMT

I have two questions about primitive polynomials (mod 2):

1)  I was under the impression that if the feedback sequence of a LFSR is
a primitive polynomial (mod 2), then the period of the LFSR is 2^n - 1, where
n is the degree of the polynomial.  I recently got a copy of Zierler and
Brillhart's paper:  "On Primitive Trinomials (mod 2)," Information and 
Control, 13 (1968), 541-554.  The article implies that this is not the case:
"Those n where 2^n - 1 is completely factored, but for which the periods of
the irreducable T_n,k(x) have not as yet been determined...."

2)  Near as I can tell, if x^p + x^q + 1 is a primitive trinomial (mod 2), then
so is x^p + x^(p-q) + 1.  Does this property extend to polynomials with more
coefficients?  Assuming that x^p + x^q + x^r + 1 is primitive, what other
polynomial is necessarily primitive?  Assuming that x^p + x^q + x^r + x^s + 1
is primitive, what other polynomial is necessarily primitive?

Bruce
From: slimick+@pitt.edu (John C Slimick)
Newsgroups: sci.crypt
Subject: VCR+ compression
Date: 12 Jan 93 00:57:48 GMT
Distribution: usa
Organization: University of Pittsburgh
Originator: slimick@unixd3.cis.pitt.edu


I posted a request for the VCR+ formula on
comp.compression and I was steered here. Although
I believe that this is a better example of compression
(compressing d.o.w, start time, duration, and channel)
than cryptography, I would like to use the formula
as an example of one or the other for my
data communications class. Can someone help?

e-mail to: slimick+@pitt.edu

and thx in advance
john slimick
university of pittsburgh at bradford

Newsgroups: sci.crypt,alt.security,alt.security.pgp
From: cbbrowne@csi.uottawa.ca (Christopher Browne)
Subject: Re: PGP 2.1 source posted to alt.sources
Organization: Dept. of Computer Science, University of Ottawa
Date: Fri, 8 Jan 93 15:50:07 GMT

In article <C0IFAw.3vy@bcstec.ca.boeing.com> vanzwol@bcstec.ca.boeing.com (Ted Van Zwol) writes:
>This intrigues me.  I'm not accusing you (Peter) of anything, but consider:
>
>How do we know the PGP sources on alt.sources (or even that on any FTP site
>for that matter) are "safe".  What kind of precautions or checks exist to
>prevent bogus code from cropping up.  Why couldn't some intelligence agency
>get their hands on the code and weaken the encryption algorithm just enough
>for them and then distribute the modified source to the rest of the world.
>
>I haven't looked at the source or the comments myself, so I don't know if
>this is already addressed.  But, it concerns me.  Who's to say the copies of
>PGP available are trustworthy?  I'm terribly confused...

The best idea would probably be to have an MD5 signature of (say) the actual
text of each post appended to the end.  Said signatures could then be
published either in:
a) sci.crypt
b) Some moderated newsgroup?
c) The C Users Group magazine?

or somewhere such.

-- 
Christopher Browne                |     PGP 2.0 key available
cbbrowne@csi.uottawa.ca           |======================================
University of Ottawa              | Genius may have its limitations, but
Master of System Science Program  | stupidity is not thus handicapped.
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Newsgroups: sci.crypt
Subject: Re: Complete ITAR Available
Date: 11 Jan 93 23:08:02 GMT
Organization: Beckman Instruments, Inc.

In <1993Jan11.003432.15501@netcom.com> strnlght@netcom.com (David Sternlight) writes:


>Putting it another way, if PGP infringes, then the author does not
>have the legal right to declare it public domain, in that he doesn't
>own the infringing portion. To see this clearly, suppose I upload a
>copy of Microsoft Word and declare it public domain. Saying so doesn't
>make it so, and Microsoft could not only prosecute me, but also anyone
>with a copy.

Copyright law is different than the ITAR and (as you pointed out) patent law.

>Some have tried to argue that if they weren't the person uploading PGP
>originally, they could download and use it with impunity. As one can
>see from the above reduction ad absurdum, this cannot be or the only
>person Microsoft could go after would be the original uploader, but
>not those with copies of that upload. Worked examples include
>successful piracy prosecutions in the courts.

Your quote of patent law on imports appeared to state that ONLY the
importer can be prosecuted importing objects made with a process subject to
a process patent.
--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Newsgroups: sci.crypt
From: Owen.Lewis@purplet.demon.co.uk (Owen Lewis)
Subject: Re: Zimmermann's response
Organization: FidoNet node 2:252/305 - The Purple Tentacle, Reading
Date: Tue, 12 Jan 1993 18:27:00 +0000

 -=> Quoting Rob Stampfli to All <=-

 RS> It is not my intent to add fuel to any fire, 

 Likewise.

 RS> Pgp seeds certain random number vectors by asking the
 RS> user to type some characters at the terminal and then measuring the
 RS> times between keystrokes.....it probably works well in a DOS environment.  
 
 As some may have noticed, I don't type particularly well or fast (I thought), 
 using two fingers and a thumb. However, several times, when experimenting 
 with PGP2.1 key construction, I have received screen messages requiring me 
 to add to the character stream as some earlier characters had been typed in 
 too fast. I understand this to mean that the time interval from one 
 character to the next was too small for the key generation program (under DOS)
 to use. Though noting the occurences, until Rob's post, I did not give them
 much further thought. 
 
 Does anyone know what the limits on the time interval measurement are and 
 what effect this will have on the random number vectors?

 Owen
___ Blue Wave/QWK v2.11

Newsgroups: sci.crypt
From: Owen.Lewis@purplet.demon.co.uk (Owen Lewis)
Subject: Re: Motorola 'Secure-Clea
Organization: FidoNet node 2:252/305 - The Purple Tentacle, Reading
Date: Fri, 8 Jan 1993 01:33:00 +0000

 -=> Quoting Robert Cain to All <=-

 RC> : 
 :  TD> ......... simple speech inversion really shouldn't be called a
 :  TD> security device.
 
 RC> What about the modern analog devices that use split band inversion
 RC> where one of 32 programmable split points in the voice band may be
 RC> selected and changed at 60 Hz or faster at "random?"  .......
                             
 RC> Combine this with spread spectrum or Pulson modulation and, well....


  Well.....We were talking about simple speech inverters. But, to up the 
  ante; yes, in my opinion split band rolling code inverters are  
  vulnerable. I offer these thoughts in support of this position.

                1. Assume that recovery of information does not have to 
  be in real time. The analyst will know that what he is trying to work back 
  to (i.e. analogue speech waveforms) contain many predictabilities. That 
  knowledge alone makes plain brute force attack unnecessary and undermines 
  the theoretical protection of a given number of combinations.
                
                2. The use of an intermediate analogue medium, that of 
  sight, might assist an analyst in recreating predictable patterns.
                
                3. Such good scramblers are relatively freely available on 
  the open market internationally for wireless use, while powerful encryptors 
  are not. 
  
                4. 'Less than fully secure' is a term often used by good 
  manufacturers themselves. Though I have met (usually junior) sales staff
  from reputable companies who will make out otherwise.

                5. There is, I believe, an analogy to the security provided  
  by passwords. Viewed on a straight number crunching basis (as is discussed 
  elsewhere) an 8 character password is impressively strong. But....... 
  

        As for Pulson modulation, no comment! I look forward to furthering my 
  education in due course!



___ Blue Wave/QWK v2.11