HDTenEightyP/NetNews huggingface dataset:
From: frank@D012S436.sniap.mchp.sni.de ()
Subject: Re: User authentication
Organization: Siemens-Nixdorf AG
Date: Mon, 31 Aug 92 13:55:12 GMT

cme@ellisun.sw.stratus.com (Carl Ellison) writes:
: In article <1992Aug28.140721.599@sniap.mchp.sni.de> frank@D012S436.sniap.mchp.sni.de writes:
: > O.K., I'm IBM.  Our key is:
: >
: >	begin bigblue.key
: >	;:;:;:;;ABB<<DDDHEHHEUUUU
: >	end
: >
: >
: >Now, can I withdraw some money from our account?
: 
: No problem.
: 
: Your account is named by your public key -- not by some silly collection
: of letters, such as "IBM".

Don't be silly, we have no public key accounts just yet - I'm
delivering you the VERY FIRST KEY FOR IBM.

: 
: The money in the account all came from the person who knew the factorization
: of that RSA key -- so the person who knows the factorization is allowed
: to take it out.

It's IBMs account.  The money in the account came from IBM, there 
are no public key accounts yet.

What I'm trying to show you is that you will need some 
proof that I represent IBM (I don't :-)  *before* you will 
accept my key and set up my/our "RSA account".  The
original poster was saying that unidentified keys
are acceptable for groups - they're not, though they
may be alright for anonymous posting type applications.

IBM probably hasn't that much money anymore, in any case :-)

--
Frank O'Dwyer		       			Disclaimer: 
Siemens-Nixdorf AG 	                        I will deny everything
Tel.  : +49 (89) 636-40639                      Fax.  : +49 (89) 636-45860
e-mail: Frank.ODwyer@sniap.mchp.sni.de
Newsgroups: sci.crypt
From: mjr@hussar.dco.dec.com (Marcus J. Ranum)
Subject: Re: GCHQ's location. No big secret!
Organization: Digital Equipment Corporation, Washington ULTRIX Resource Center
Date: Tue, 1 Sep 1992 21:25:09 GMT

>Then there's the famous story about the time they were building CIA
>headquarters, and a local real estate developer wanted to know how
>many employees would be housed there, so he could plan some residential
>developments nearby. He was completely stonewalled, so he called the
>Soviet Embassy and they told him. They had it just about dead on.

	This story made my brand new Capt. Kelly bullshit detector
explode violently, and was only by sheerest luck that nobody was
injured.
	I was going to say "it's an urban legend" but it's not even
as believable as crocodiles in the sewers.

mjr.
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: User authentication
Date: 28 Aug 92 22:36:50 GMT
Organization: Stratus Computer, Software Engineering

In article <1992Aug28.140721.599@sniap.mchp.sni.de> frank@D012S436.sniap.mchp.sni.de writes:
> O.K., I'm IBM.  Our key is:
>
>	begin bigblue.key
>	;:;:;:;;ABB<<DDDHEHHEUUUU
>	end
>
>
>Now, can I withdraw some money from our account?

No problem.

Your account is named by your public key -- not by some silly collection
of letters, such as "IBM".

The money in the account all came from the person who knew the factorization
of that RSA key -- so the person who knows the factorization is allowed
to take it out.

Glad to meet you, IBM.

However, I don't see any money in the account # ;:;:;:;;ABB<<DDDHEHHEUUUU

Sorry.
Newsgroups: sci.crypt
From: pausch@saaf.se (Paul Schlyter)
Subject: Re: User authentication (was Re: secure netnews)
Organization: SAAF, Svensk Amat|rAstronomisk F|rening
Distribution: sci
Date: Wed, 26 Aug 92 21:17:46 GMT

In article <5894@transfer.stratus.com> cme@ellisun.sw.stratus.com (Carl Ellison) writes:
>In article <1992Aug21.864.168@ALMAC> keith.willis@almac.co.uk writes:
>>
>>        RSA public keys certified by genetic fingerprint, that being
>>        verifiable against that held by a central trusted authority?
>>
>
>
>I just don't see what the big deal is.  You'll never meet me.  You
>can't care what I look like much less what genes I have.  If you were to
>know, would that make my identification any more positive?
>
>
>If I give you an RSA key, that's all you need.  I'm the only one in the world
>who knows the two primes in N.  That defines *me*.  Balding head or not,
>height, weight, ..., even gender is all irrelevant.
>
>I can prove I know those primes by signing something.  You can verify that
>I know the primes, without learning the primes -- therefore without becoming
>able to pretend to be me.
>
>What more do you want?


Well, you can't prove that you've kept those primes secret and haven't told
anybody else about them, for instance....

And during such circumstances (we've never met and never will meet, I'm not
interested in any positive ID like genes, fingerprints etc, and all I know
is that you say that you've signed a messages and haven't revealed to anyone
else how to sign it in the same way), who needs RSA signatures?  They would
really say no more than your name and email address. Actually they would
even say less, since your email address at least tells where you're located.

For RSA signatures to be meaningful, there must be a good reason to use it.
I.e. the sender must have a good reason not to reveal his signatures, and
the receiver must have a good reason to know who actually sent the message.
If this doesn't metter too much, then RSA is not needed.

-- 
---
Paul Schlyter, Swedish Amateur Astronomer's Society (SAAF)
Nybrogatan 75 A, 6 tr,  S-114 40 Stockholm,  Sweden
InterNet:  pausch@saaf.se
Newsgroups: sci.crypt
Subject: Re: CIA story (was : GCHQ's location ..)
From: Peter Gutmann (pgut1@cs.aukuni.ac.nz)
Date: Fri, 4 Sep 1992 05:03:12 GMT
Organization: Computer Science Dept. University of Auckland

In <1992Sep2.202521.13367@sctc.com> smith@sctc.com (Rick Smith) writes:

>The "real truth" behind this story could be anything. Maybe it's true
>as stated, though I don't know why the Soviets would be so helpful.
>Maybe the developer made up the numbers and wanted free publicity.

Why doesn't someone phone the embassy and ask them?  (OK, so finding the
Soviet Embassy may be a bit difficult, but whatever it is that's now
performing the function).

--
   pgut1@cs.aukuni.ac.nz || peterg@kcbbs.gen.nz || peter@nacjack.gen.nz
	 or sling a bottle in the ocean, it's about as reliable.
Newsgroups: sci.crypt
From: leonard@qiclab.scn.rain.com (Leonard Erickson)
Subject: Re: "Sneakers" -- action/adventure movie about Cryptography
Reply-To: 70465.203@compuserve.com
Organization: SCN Research/Qic Laboratories of Tigard, Oregon.
Date: Fri, 4 Sep 1992 01:25:39 GMT

ranck@vtserf.cc.vt.edu (Wm. L. Ranck) writes:

>   I saw a preview of "Sneakers" when I was at the movies about a week ago.
>In a couple of scenes they showed groups of letters on a screen rapidly
>changing (sort of like a slot machine) and resolving into words.  Now this
>bothered me.  The space characters were already in place!  In other words
>it was obvious from the cyphertext what the length of each word was.
>Pretty poor encryption scheme that.

The average person knows *nothing* about encryption. About 7-10 years ago
a local BBS was essentially one continuing series "round-robin" stories. 
Some folks (most of whom are on the Internet now!) were doing one that
was a cross between computer hacker stuff and spy stories. We decided to
use some *simple* ciphers on messages. 90% of the poeople who said that
they'd have "no trouble" reading them couldn't crack a simple Caesar
cipher (done in standard 5 character groups). "Where are the words?"

We lost another 90% with a simple change to a polyalphabetic cipher with
a fixed key. Changing to a key that changed according to a known (to us)
paterrn lost all but two of them. 

We finally achieved security when we switched to bitwise encryption.
It was an interesting excercise. Especially in seeing how few people
could "crack" a code when given *broad* hints!



just for old times sake.....

RYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRY
JQWST HBAMQ VB@SR EJPPF ^\CEN IPWHZ KVLUY PZBRF NIWVZ NQ@IE PV\HB MLEQT 
PZKNL UYGRC HJATE EF]CA NQZWF HCRLU XF^\S TNLPF ^[Q@N QTFJH CPNIW VN\SE 
NMYR@ [[FDA \V^]K RDATV \YSIM QZGDX KTMEW V\HCI MYZF^ HCTMA RPZBR CM]VW 
@]KTL UYB@X [OMUV WJ[SI NQ\R@ XKRLT PGDYK QNURW F]CEL PW@ZB PMAID RN]SE 
DATV\ YSIMQ ZGDXK TLURB @QSIL QWV\Y KTEXP DB[SD DADR@ Z[NM] [R@]C HLEZB 
@\[EN YRWDX KLDAW VLHCY M]ZR@ XKRLT PFB]@ MAITV Z\CON IZFB[ STDAD V\]CE 
NIWFJ ]A@NM TWHYK SEXP@ ZBPMA IRV\Y A@NQY FB[SS MUTWF \[IM] W@ZBP 
RYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRY

:-)

-- 
Leonard Erickson		      leonard@qiclab.scn.rain.com
CIS: [70465,203]			 70465.203@compuserve.com
FIDO:   1:105/51	 Leonard.Erickson@f51.n105.z1.fidonet.org
(The CIS & Fido addresses are preferred)
Xref: sparky sci.crypt:3089 comp.security.misc:1131
From: copper@WATSON.IBM.COM ("Don Coppersmith")
Newsgroups: sci.crypt
Subject: Re: Bias in ACM and IEEE articles on cryptography
Date: 26 Aug 92 14:27:35 GMT
Reply-To: COPPER@ibm.com

Andrew Haley ( ahaley@eoe.co.uk ) writes:

>                                    There's no point in using any more
> key bits, because differential cryptanalysis will find the subkeys in
> 2**47 operations whatever the key length.
........----------

The Biham-Shamir work requires 2**47 _chosen_plaintext_ messages,
not just that many operations.  Running 2**47 > 10**14 messages past
the machine that contains the secret key is _much_ trickier than doing
that many operations on your own machine.  This respresents massive
data that you've got to get out of your opponent's machine!

Don Coppersmith
From: keith.willis@almac.co.uk
Newsgroups: sci.crypt
Subject: authentication
Date: 28 Aug 92 12:31:27 GMT
Distribution: sci
Organization: ALMAC BBS Ltd



[on 25 Aug 1992, Carl Ellison said]

CE>   I just don't see what the big deal is.  You'll never meet me.  You
CE>   can't care what I look like much less what genes I have.  If you were to
CE>   know, would that make my identification any more positive?

        Oh, I agree.  But in the given scenario, which was that I
        had to come to some arrangement with an unknown person, you
        for example, which would allow me to know for definite that
        future communications purporting to come from you, were in
        fact from you.  A rider was that a third person was posited
        who was deliberately attempting to subvert this secure
        channel (I believe it was 'George Bush's evil brother
        Skippy':-).

CE>   If I give you an RSA key, that's all you need.  I'm the only one in the world
CE>   who knows the two primes in N.  That defines *me*.  Balding head or not,

        As I said before, I have no way of knowing, for example, that
        the public key that you see attached to the foot of this
        letter is the one I put there.  A hypothetical intruder
        could substitute his own.  Likewise, when you send your key
        to _me_, he could do the same.  That way, he could intercept
        your mail to me, read it, alter it, and then encrypt a
        completely different message, forward it to me, and I would
        have no way of knowing that it did not come from you.

        Maybe I'm missing something here, but I keep coming back to
        the idea that a 'trusted central authority' is always
        required.

CE>   What more do you want?

        A bit more <g>


---
 ~ PQ 2.15 194 ~ 
-- keith.willis@almac.co.uk --------------PGP v1.0 public key

section 1 of xxencode 5.15 of file keith.pub    by R.E.M.

begin 644 keith.pub
haP++EVMp8WdLOKlgOLAg62hZOLFc60+U60-fNKZoO0trOKlgOLB+MKlhMKAi
hMqwiRKjS+yJyZtYZQTYA4SG-hicSo98DNzwCFBRrYnazPCxQocdfDsxJmvo0
htIFn-XszZZFRZP4qMkiQN8JTNxApqAeD6LnR+XBHn9S89L+FovMBMl8UzU0d
gdm6JBZFu8wURFrIGcpQs8yrb5bsgM1mEXUPRx64UdlSE1GAIbUaNanQ3+-23
+
end
sum -r/size 64445/274 section (from "begin" to "end")
sum -r/size 57997/179 entire input file
--
ALMAC BBS Ltd. 0324-665371
Dos based USENET access,  call for details!
Newsgroups: sci.crypt
From: brnstnd@nyu.edu (D. J. Bernstein)
Newsgroups: sci.crypt
Subject: Re: RSA-129 contest
Date: 25 Aug 92 19:18:43 GMT
Organization: IR

In article <1992Aug24.224449.19714@unislc.uucp> erc@unislc.uucp (Ed Carp) writes:
> Hey, Dan, a question:  why do you always have to attempt to assert your
> "knowledge" by insulting your readers?

Hey, Ed, I'm not asserting my knowledge here.

*Nobody* knows how to accurately estimate the time GNFS will take on a
given number. I don't. Bob Silverman doesn't. Len Adleman doesn't. This
isn't an insult: this is fact.

Bob says GNFS will take longer than MPQS on RSA-129, based on his
``estimates.'' I challenge him to say what the estimates are---to say
``GNFS will take longer than [say] 8000 MIPS-years.'' He doesn't. This
proves my point.

Instead he challenges me, saying, ``Dan, why don't you say what your
estimates are?'' The answer is obvious: *I don't know*. I don't yet have
reliable estimates, and until somebody factors a 130-digit general
number, *nobody* will have reliable estimates.

Get it, Ed?

---Dan
Newsgroups: sci.crypt
From: jac54@cas.org ()
Subject: Re: GCHQ's location. No big secret!
Organization: Chemical Abstracts Service, Columbus, Ohio
Date: Wed, 2 Sep 1992 10:49:51 GMT

In article <1992Sep1.212509.28555@decuac.dec.com> mjr@hussar.dco.dec.com (Marcus J. Ranum) writes:
>>Then there's the famous story about the time they were building CIA
>>headquarters, and a local real estate developer wanted to know how
>>many employees would be housed there, so he could plan some residential
>>developments nearby. He was completely stonewalled, so he called the
>>Soviet Embassy and they told him. They had it just about dead on.
>
>       This story made my brand new Capt. Kelly bullshit detector
>explode violently, and was only by sheerest luck that nobody was
>injured.
>       I was going to say "it's an urban legend" but it's not even
>as believable as crocodiles in the sewers.
>
	Yes, but the story about the air-conditioning at Langley is true.
	The contractor wasn't given enough information to do anything other
	than guess what the requirements were.  I have it on good
	authority that you can't tell the difference between the inside
	and the outside, summer or winter.

	Alec.
Newsgroups: sci.crypt
From: dla@athena (Don Alvarez)
Subject: Re: Wordperfect file-locking (faq?)
Originator: news@nimaster
Keywords: WordPerfect, encryption
Organization: Princeton University
Date: Thu, 3 Sep 1992 21:08:35 GMT

In article <adamsd.715442992@crash> adamsd@crash.cts.com (Adams Douglas) writes:

>[...] Wordperfect 5.1 is easily broken.
>Why is it so easily crackable?  Were they just lazy, or what?

Suppose they had used DES.  The same people who regularly forget that
they used their first name as their login password will forget that
they used the name of the file as the encryption key.  Now their
100 page annual report is completely lost, with no hope of ever
getting it back.

Suppose they use some nothing idiot encryption like rot-13.  Most
people in a given office probably don't know how to crack it, so it
provides reasonable security.  When the user forgets the key, however,
it *is* possible to find a way to recover the data.

Very few MIS departments would want to hand every secretary in the
company an unrecoverable encryption option in a word processor.
The damage it would inevitably do when the users forget their keys six months
from now would generally far outweigh the security benefits in the mean time.
A few people at a few companies may really need DES, and if they do
they can go out and get a third party encryption package.  

-don alvarez
Newsgroups: sci.crypt
From: frank@D012S436.sniap.mchp.sni.de ()
Subject: Re: User authentication
Organization: Siemens-Nixdorf AG
Date: Fri, 28 Aug 92 14:07:21 GMT

brnstnd@nyu.edu (D. J. Bernstein) writes:
: If you hear that IBM just did something, do you care what *real people*
: are involved in making that decision for IBM? You might, but IBM doesn't
: have to tell you, and business will go on even if you don't know. The
: only problem---the problem that public-key cryptography solves---is that
: somebody else might pretend to be IBM, the IBM you already know, without
: IBM's approval. If IBM signs its messages then this problem disappears.


Does it?  O.K., I'm IBM.  Our key is:

	begin bigblue.key
	;:;:;:;;ABB<<DDDHEHHEUUUU
	end


Now, can I withdraw some money from our account?  I want to
buy a Mac.  Oops!  Blown it.
--
Frank O'Dwyer		       			Disclaimer: 
Siemens-Nixdorf AG 	                        I will deny everything
Tel.  : +49 (89) 636-40639                      Fax.  : +49 (89) 636-45860
e-mail: Frank.ODwyer@sniap.mchp.sni.de
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: User authentication
Date: 1 Sep 92 18:07:00 GMT
Organization: Stratus Computer, Software Engineering

In article <1992Aug31.135512.16204@sniap.mchp.sni.de> frank@D012S436.sniap.mchp.sni.de writes:
>: Your account is named by your public key -- not by some silly collection
>: of letters, such as "IBM".
>
>Don't be silly, we have no public key accounts just yet - I'm
>delivering you the VERY FIRST KEY FOR IBM.


If there are no public key accounts, then you can't be delivering a public
key.  To deliver the public key, you need a bank willing to take public
keys.  That means there are accounts.  Once there are accounts, any
deposits into them will have to be made with the public key.

Such accounts have nothing to do with any non-public-key accounts which any
corporation might or might not have in any other bank.

And, as I said, once you have a public key account, I don't care what
pronounceable name you use.  I (the bank) will ignore it.  The only thing
which matters is the public key.
From: ariel@world.std.com (Robert L Ullmann)
Newsgroups: sci.crypt
Subject: Re: DES source code for Aliens
Date: 25 Aug 92 23:08:15 GMT
Organization: The World in Boston

amesml@monu1.cc.monash.edu.au (Mark L. Ames) writes:
> There have been a number of requests for DES source code in this group.
...
> US export regulations prohibit the export of DES source code or the
> passing of it to what the US government quaintly and officially calls
> "aliens" (non-US citizens). This code, by Eric Young, is fast and 
> available even to extraterrestials with ftp capability.
> 
> Perhaps it should be restricted to non-US citizens only :-).

:-)

Note that it is entirely legal for US citizens (or anyone in the US)
to IMPORT DES code; do feel free to access the FTP sites mentioned.

But (the silly part:) you can't then RE-EXPORT it. So don't: just
include a reference so your customer/whatever can get it themselves.

It ain't Born Classified, but once it gets here, it is ... this
is a really good example of just how ridiculous the restrictions
have become; time to forget about software, and let the (limited)
enforcement resources concentrate on things like Klytrons and
kilograms of Plu-235. [end political soapbox]

--
Robert Ullmann		Ariel@World.STD.COM	+1 508 879 6994 x226
Quand Maigret poussa la porte du Tabac Fontaine, vers une heure et demie,
le patron du bar, qui venait de se lever, descendait lentement un escalier
en colima gon qui s'amor gait dans l'arri hre-salle. ... Arriv i derri hre le
comptoir, il repousa le gar gon d'un geste n igligent de la main, saisit
une bouteille de vin blanc, un verre, m ilangea au vin d l'eau min irale et,
la t jte renvers ie en arri hre, se gargarisa.  -- Simenon
From: marc@tanda.isis.org (Marc Thibault)
Newsgroups: sci.crypt
Subject: Re: PGP for Unix?
Date: 30 Aug 92 22:57:08 GMT
Reply-To: marc@tanda.isis.org
Distribution: na
Organization: Thibault & Friends

In article <1992Aug29.143238.6873@nntp.hut.fi> 
(Jyrki Kuoppala) writes: 
     ...
> 
> kauri.vuw.ac.nz was also mentioned, but I found only the ms-dog
> version there.
> 

        pgp10 works just fine on my dog. Maybe that's because there's
        just one breed, and it's easily trained.


---
 Marc Thibault        |                              |  Any Warming,
 marc@tanda.isis.org  |  Oxford Mills, Ontario       |  Global or otherwise,
 CIS:71441,2226       |     Canada                   |   appreciated.
Newsgroups: sci.crypt
Subject: Re: Unix compatible crypt utility needed
From: jbickers@templar.actrix.gen.nz (John Bickers)
Date: 28 Aug 92 08:43:02 PST
Organization: TAP, NZAmigaUG

Quoted from <phil.714897700@adam.adelaide.edu.au> by phil@adam.adelaide.edu.au (Phil Kernick):

> If they have been encrypted by DES then this is a one way algorithm, and
> hence you can't get the text back.

    DES isn't a one-way function. You can get the data back if you
    know the key.

> Phil.
--
*** John Bickers, TAP, NZAmigaUG.        jbickers@templar.actrix.gen.nz ***
***    "Radioactivity - It's in the air, for you and me" - Kraftwerk    ***
From: smb@ulysses.att.com (Steven Bellovin)
Newsgroups: sci.crypt
Subject: Re: RSA-129 contest
Date: 26 Aug 92 00:51:31 GMT

In article <5462.Aug2519.18.4392@virtualnews.nyu.edu>, brnstnd@nyu.edu (D. J. Bernstein) writes:
> Hey, Ed, I'm not asserting my knowledge here.
> 
> *Nobody* knows how to accurately estimate the time GNFS will take on a
> given number. I don't. Bob Silverman doesn't. Len Adleman doesn't. This
> isn't an insult: this is fact.

Dan, there are ways to say such things politely.  In fact, you've more
or less managed it here.  Your previous postings on the subject were
insulting in the extreme.  If you don't understand why, think about it
some more.

Btw, given Bob's reputation in the field, I'm inclined to trust his
guesses more than yours.  Perhaps, in a few years, you'll have achieved
equal stature.  If and when that happens, your educated guesses will e
entitled to equal respect.
From: ho@cs.arizona.edu (Hilarie Orman)
Newsgroups: sci.crypt
Subject: Re: User authentication
Date: 27 Aug 92 21:43:19 GMT

In article <9208261827.AA02445@news.cis.ohio-state.edu>, Marc.Ringuette@daisy.learning.cs.cmu.edu writes:

|>  It takes 20 years to create a person.

Please note that mileage may vary.

Newsgroups: sci.crypt
From: adamsd@crash.cts.com (Adams Douglas)
Subject: Wordperfect file-locking (faq?)
Date: 2 Sep 92 14:09:52 GMT
Keywords: WordPerfect, encryption

 It's my understanding that the file-locking algorithm in Wordperfect 5.1
is easily broken. Is this something that can be fixed or guarded against 
(without actually doing something outside the program)? Why is it so
easily crackable? Were they just lazy, or what?

Sorry if this is a FAQ. Just email replies to me to save eye-time for others.

And, yes, although I'm curious how one _does_ crack it, I'm more interested
in how to fix it - if it can be.

Xref: sparky sci.crypt:3082 alt.security:4230 comp.security.misc:1127