HDTenEightyP/NetNews huggingface dataset:
From: wcs@anchor.ho.att.com (Bill Stewart +1-908-949-0705)
Subject: Re: Chosen crypto-text attack on RSA
Organization: Here, beside the rising tide
Date: Mon, 14 Dec 1992 00:16:59 GMT
	<1992Dec13.150444.8941@src.umd.edu>

   In article <YSN9FVS@minnie.zdv.uni-mainz.de> pom@anke.imsd.uni-mainz.DE (Prof. Dr. Klaus Pommerening) writes:
   >[technique for stealing messages if you can get someone to 
   > sign them by decrypting with their public key as an
   > acknowledgement of receipt.]
   >Never sign a document that Charles presents to you!

It was an interesting attack, and demonstrated that there are stupid
ways to use any technique, but the fundamental weakness was that
the protocol assumed that Alice would sign a document without reading it first.

This is just as stupid in the electronic world as it is in the paper world -
Imagine if the post office used registered-mail receipts like
	Pay Charlie $1000000 from my account, signed ____________

The most you would typically use for an delivery-acknowledgement protocol
would be to sign a checksum (MD5 or whatever) or a document,
or more likely to sign a note saying
	I received message with checksum 765765765 at time 14:37
		signed Alice
which doesn't let your attack work.
--
#				Pray for peace;      Bill
# Bill Stewart 908-949-0705 wcs@anchor.att.com AT&T Bell Labs 4M312 Holmdel NJ
# Nov 12 - Anniversary of Indonesian massacre in East Timor, 1991
# Indonesia first invaded in 1975, and about 1/3 of the people have been killed.
Xref: sparky sci.crypt:5909 alt.security:5166
From: strnlght@netcom.com (David Sternlight)
Newsgroups: sci.crypt,alt.security
Subject: Re: PGP v. 2.1 Released
Date: 18 Dec 92 21:57:50 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)


Tim Moore makes the interesting point that PGP 2.x contains RSADSI code
for the MD5 algorithm. He goes on to say it's licensed to all.

Aha! The smoking gun?

RSA/PKP are not obligated to license to anyone, and may deny or even
withdraw licenses for what they consider to be cause. If they were to
take the position that PGP users are not entitled to a license then
this would be "proof", if any further proof were needed, that PGP2.x
contains illegal code. I believe that even outside the U.S. the use of
someone else's code without permission is at least a copyright
violation in most countries, including many from which PGP defenders
are writing from.

David
Newsgroups: sci.crypt,alt.security
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP v. 2.1 Released
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 18 Dec 1992 22:07:37 GMT


Arthur Rubin quotes a charge by another that PKP alleges Zimmerman
stole ideas from Mailsafe. This is a false rendering of what
Jim Bidzos said. (I notice that there's a lot of demonizing of
PKP going on here.)

In the Zimmerman telegram (sorry, couldn't resist) Phil says
he didn't take ideas from Mailsafe.

That's what Bidzos had claimed--that Phil took ideas. Bidzos' message
was explicit that such a practice wasn't illegal. Thus there was no
charge of stealing made by PKP on that matter.  What PKP did claim
(and Phil denied) was that Phil claimed (ready for another soap opera
sentence structure, boys and girls) PGP 1.x was all his own work, but
that Phil had Mailsafe and that a lot of ideas in 1.x were taken from
Mailsafe and thus those IDEAS weren't original with Phil. It was a
part of Bidzos message that I personally regret, in which Phil's
motives were being called into question. It seems to me we should keep
this, on all sides, to the facts, law, and ethics of the matter, but
not resort to imputing motives to people on any side of this issue.

David

Newsgroups: sci.crypt
From: bosman@fwi.uva.nl (Cor Bosman)
Subject: Re: PGP 2.1 version for amiga computer
Organization: FWI, University of Amsterdam
Date: Mon, 14 Dec 1992 14:57:35 GMT

bx017@cleveland.Freenet.Edu (Michel Aubin) writes:


>hello
> 
>i want have a informatin concern PGP 2.1 .. for Amiga Computer
> 
>Where i can find the PGP 2.1 Version For AMIGA COMPUTER.. On FTP Internet??
> 
>Bye ..
> 
>					Michel Aubin
>-- 
>Address Internet-=>Bx017@po.cwru.edu
>Address Internet-=>Maubin@heartland.bradley.edu
>Address Fidonet.-=>1:240:507  (My Name is Michel Aubin)  (On Bab-O-Manie)

Amiga PGP2.1 will be available soon, there is this little bug I
am tracing down..patience :)

cor bosman
-- 
|bosman@fwi.uva.nl_   //     | Honest Officer , had I known my health      |
|-----------------\\ //AMIGA | stood in jeopardy I would never had lit one.|
|  PE no.1         \\/       |             -MAXIM (of the Hells Angels)-   |
|__________ Quickly Scotty,beam me up.There is no ox..y..ge..._____________|
From: Pat_Barron@transarc.com
Newsgroups: sci.crypt
Subject: More RSA questions
Date: 18 Dec 92 06:37:17 GMT
Article-I.D.: transarc.AfATsxL0Bwx2F93KFX
Organization: Carnegie Mellon, Pittsburgh, PA

I was tinkering around with the RSA algorithm last night, using really
small primes (e.g., 13 and 17) to generate keys.  The idea was that I
only wanted to use a 16-bit modulus, so I could avoid doing any
extended precision arithmetic, and so I could do the exponentation via
a naive "compute x^y by looping and multiplying by x, y times
(remember, this is just a toy implementation, and it's not intended
to do any "real" work).  But I ran into a few snags:

1)  During the exponentiation, the numbers get *really* big.  Like, I
was shocked at how quickly they got big.  Is there any shortcut for
computing m^e mod n, without actually computing m^e first?  Like, can
I loop somehow, accumulating partial results, until at the end I have
the value m^e mod n, without having actually computed m^e first?  Even
if I choose, say, 3 or 5 as the private key, the public exponent tends
to be big enough that m^e is way beyond the capacity of a 32-bit
unsigned integer.

2)  I chose the private key and public exponent by brute force.  Is
a better way to choose the private key than to factor (p-1)(q-1) and
choose something with no common factors?  Is there a better way to
find the public exponent than just trying all the possible values
until you find it (which is what I did)?

--Pat.
Newsgroups: sci.crypt
From: hmiller@lucpul.it.luc.edu (Hugh Miller)
Subject: Re: Spies using PGP
Organization: Loyola University Chicago
Date: Mon, 14 Dec 1992 15:14:58 GMT

In <1992Dec14.054304.1311@fasttech.com> zeke@fasttech.com (Bohdan Tashchuk) writes:

>I'm not really a student of bureaucracy but I'll suggest that Not Invented
>Here would be a bigger obstacle keeping an agency from adopting PGP than any
>weaknesses in it. There is a general consensus that real spooks disparage the
>use of factoring based cryptosystems, but perhaps *that* is disinformation.

That's just my point.  I'm not suggesting PGP is cryptographically weak, jus
that "Do Everything In-House" is the overriding rule.

-- 
Hugh Miller         | Dept. of Philosophy | Loyola University of Chicago
Voice: 312-508-2727 |  FAX: 312-508-2292  |    hmiller@lucpul.it.luc.edu
Newsgroups: sci.crypt
Subject: Re: Multi-way encryption/FAQ/archives?
From: pgut1@cs.aukuni.ac.nz (Peter Gutmann)
Date: Sat, 12 Dec 1992 23:49:10 GMT
Organization: Computer Science Dept. University of Auckland

Death rays from Mars made shaun@octel.com (Attack of the Dayglo Howler Monkeys)
    write:
 
>Is there some way the public-key idea can be extended to handle a centralized
>distribution point?  That is, A sends a message to a redistribution point R,
>which forwards the message on to B, C, and D.  A performs encryption, and B,
>C, and D all decrypt the message and get authentication that it was from A as
>well.  R does nothing but redistribute, and contains no keys or encryption
>software.
 
Sure, it's not hard.  This feature is a standard part of PEM (which isn't
available yet, though), will be in the next version of PGP, and is already in
HPACK (a secure archiver I released recently).  The scheme they use is
generally identical, and works as follows:
 
  Normally, a public-key encrypted file/message/whatever actually consists
  of a PKC-encrypted key for a conventional cipher (called a DEK), which is
  then used to encrypt the actual message.
 
Lets say you have a PKC 'P', a conventional cipher 'E'.  Then the normal
PKC-encrypted message would be:
 
    P     ( DEK ) + E   ( message )
     userA           DEK
 
ie the DEK encrypted with the key of userA, followed by the message itself
encrypted with the DEK.
 
Extending this to allow multiple recipients is quite simple.  Just use:
 
    P     ( DEK ) + P     ( DEK ) + ... + P      ( DEK ) + E   ( message )
     userA           userB                 user n           DEK
 
When someone wants to decrypt this message, they look for the public-key
encrypted DEK packet which corresponds to their secret key, use the secret key
to decrypt the DEK, and then use the DEK to decrypt the message itself.
 
The advantages are obvious - it's great for doing things like secure mailing
lists, or anything which has to go to multiple recipients.
 
The disadvantages are that it's only as strong as the weakest link - if just
one of the secret keys are compromised then the DEK is revealed and anyone can
read the encrypted data - you have to make sure you trust everyone being sent
the data.
 
Peter.
--
 pgut1@cs.aukuni.ac.nz||p_gutmann@cs.aukuni.ac.nz||gutmann_p@kosmos.wcc.govt.nz
peterg@kcbbs.gen.nz||peter@nacjack.gen.nz||peter@phlarnschlorpht.nacjack.gen.nz
               (In order of preference - one of 'ems bound to work)

Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy
From: felixg@coop.com (Felix Gallo)
Subject: Re: drug dealers on the high seas (was Risks of Using PGP 2.0)
Organization: None
Date: Wed, 16 Dec 1992 15:10:03 GMT
Followup-To: poster

res@colnet.cmhnet.org (Rob Stampfli) writes:
>>Actually, it IS a crime to transport drugs anywhere in the world.  There
>>is NO country that has made it legal.
>
>Try the United States -- specifically, the 21st amendment to the United States
>Constitution, which expressly makes it legal to manufacture, transport, and
>sell intoxicating liquors in the US, except as restricted by state law. 
>Suppose a ship carrying Kentucky's finest bound for Europe (with the newly
>relaxed trade tariffs) were seized on the high seas by a Middle Eastern
>nation wherein consumption of alcohol was strictly verbotem.  Now, further
>suppose the ship's crew were taken back to that nation, tried, found guilty,
>and sentenced to be jailed for life.
>
>Is this justice?
>
>How is this tangibly different from the scenerio that has been previously
>reported here?

The government under which the ship was flying a flag does not
have an amendment to its constitution legalizing cocaine or the
distribution of cocaine, for one thing.  For another, the boat
in your utterly specious example is heading towards Europe, not
a Middle Eastern nation.

If you will recall from the initial posting, the smugglers in
question were bound for Canada with illegal cargo [no matter who
you ask] and were known by all sorts of law enforcement officials
to be in the act of preparing for a crime.

I'm sure the U.S. could have called the Canadians up and had them
go through the trouble of getting a boat out and making the arrest,
but if they're on the scene, why bother?  Why not make a friendly
gesture towards our similar-minded brother nation?

Civil rights have their place.  But if you walk up to my neighbor's
house with a rocket launcher, aim it, load it, and point it at his
front door -- no matter whether you're on public property or not,
and no matter whether I'm the party that would get injured, don't
you think it's a good idea for me to try to put a stop to you?

>-- 
>Rob Stampfli  rob@colnet.cmhnet.org      The neat thing about standards:
>614-864-9377  HAM RADIO: kd8wk@n8jyv.oh  There are so many to choose from.
Xref: sparky sci.crypt:5881 alt.security.pgp:289
From: mathew <mathew@mantis.co.uk>
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: PKP/RSA comments on PGP legality
Date: Fri, 18 Dec 92 15:45:44 GMT
Distribution: world
Organization: Mantis Consultants, Cambridge. UK.

strnlght@netcom.com (David Sternlight) writes:
> Note that in no place does Moglen say use of PGP2.0 in the US. is legal. In n
> place does he say one isn't violating the Munitions Act. He even concedes it'
> a "civil WRONG" (emphasis added). What he says is that he thinks one is
> unlikely to be prosecuted/sued.
> 
> This means the ethical position is still unchanged in this discussion.

Please do not confuse ethics with law.  The two are pretty much orthogonal.

> Even for those who have no ethical concerns, suppose you were known to use it
> It might jeopardize your ability to pass the scrutiny needed to obtain
> government employment, receive government research funds, or work on
> government contracts if somebody, somewhere, has a note in a file about you
> "violated Munitions Act." And you'd never know. Something to think about. Lif
> is long, government files last forever, and some of the Yippees of the '60's
> now have government jobs.

All the more reason to use PGP to keep the rest of your private life away
from their prying eyes, I think.

> My position is clear. RSA has patents on a wonderful invention and they are
> entitled to the fruits of their work.

Or more precisely, the fruits of someone else's work, paid for by the US
taxpayer.


mathew
-- 
Lung cancer and arteriosclerosis.
For people who like to smoke.
From: gibson@chaos.berkeley.edu (richard Gibson)
Newsgroups: sci.crypt
Subject: need reference for checksum error detecting code
Followup-To: sci.math,comp.theory
Date: 19 Dec 1992 23:53:59 GMT
Organization: U.C. Berkeley Math. Department.
Distribution: usa
NNTP-Posting-Host: chaos.berkeley.edu

Howdy!

Someone recently brought me a problem concerning an error-detecting weighted
code with a modulo 11 checksum that she's using in her business. 

In short, a bunch of items are given 10 digit identification numbers. 
Let N_i denote the ith digit of the number.
Each number has the property that SUM(A_i * N_i) is congruent to 0 mod 11,
where {A_i} are weights as follows: {1, 2, 5, 3, 6, 4, 8, 7, 10, 9}.

The obvious advantages of this identification system are that no single
digit errors in a valid number and no single transposition of digits in
a valid number will produce another valid number. 

Question: What is the advantage of the weights being mixed up like that?
(i.e. why isn't A_i just set equal to i?)
References about this particular system would be the most appreciated because 
I know this weighting must have been written about somewhere. I just can't
find it.

Thanks,

Richard 
gibson@math.ucb.edu
Newsgroups: sci.crypt
From: uri@watson.ibm.com (Uri Blumenthal)
Subject: Re: Enlarging key size of the DES algorithm
Date: Thu, 17 Dec 1992 20:51:45 GMT
Reply-To: uri@watson.ibm.com
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: Why do you care?
Keywords: DES, key size

In article <BzDp6F.6zn@chinet.chi.il.us>, schneier@chinet.chi.il.us (Bruce Schneier) writes:
|> >  2)  Does anybody know of other modifications concerning the key size ?
|> 
|> There have been many.  None of them are any good.  Biham and Shamir showed
|> that DES with independent subkeys (the 768-bit key variant you mentnion) is no
|> more secure than DES.  Something else called GDES was also shown to be no more
|> secure than DES.  The security of DES seems pretty much limited to a 56-bit
|> key.

I beg to differentiate! (:-)

There are two feasible attacks [on DES]: exhaustive search and differential
cryptanalysis.

While indeed Biham-Shamir attack produces a key with probability 1 with every
2^47 chosen plaintexts - how good a chance is, that your adversary can get 
that many encryption of his stuff performed on your DES engine? Or how
likely is it for him to have similar amount of known plaintexts (and
if he does have that much of it - probably there's no need for the
key anyway, all the data passed is there :-).

Thus the only practical threat left is an exhaustive search. And
I fail to understand why the DES with independent subkeys 
(760-bit key) is "limited to 56-bit key". I'd say
it's wrong, at least from practical point 
of view.
-- 
Regards,
Uri.		uri@watson.ibm.com
------------
<Disclaimer>
Newsgroups: sci.crypt,alt.security.pgp
From: gardner@convex.com (Steve Gardner)
Subject: Re: PKP/RSA comments on PGP legality
Date: Mon, 21 Dec 1992 01:38:32 GMT
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1992Dec19.002110.17682@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>I said that government takes cryptographic violations of munitions
>laws much more seriously than the building of airplane models.
>
>Steve Gardner's response that nobody is harmed by cryptography is
>appalling. Consider the lives lost or saved through cryptographic
>activities during wars, anti-terrorism, drug enforcement, etc.
	All sorts of technology is useable in war.  Calling cryptography
	a "munition" is as stupid as calling boots munitions.  They are both
	necessary for a proper war ;-). Neither directly harms anyone. They
	both can be used to increase the effectiveness of an army. Think 
	of all the lives lost or saved because soldiers had footware.  But 
	don't get me wrong David, I do enjoy reading your jesuitical 
	defenses of the indefensible. It's an art form and you do it very 
	well. ;-)


							smg
						smg



Newsgroups: sci.crypt,demon.security,comp.privacy,alt.security.pgp,alt.privacy,bit.listserv.xtropy-l
From: whitaker@eternity.demon.co.uk (Russell Earl Whitaker)
Newsgroups: sci.crypt,alt.security
Subject: Re: PGP v. 2.1 Released
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 18 Dec 92 18:01:15 GMT
 <1g7ubgINNfb7@transfer.stratus.com><palmer.724096180@news.larc.nasa.gov><19921
   214.055706.262@almaden.ibm.com> 
 <1glvofINNc0o@roche.csl.sri.com><a_rubin.724526808@dn66> <MOORE.92Dec18095153@defmacro.cs.utah.edu>
Organization: Beckman Instruments, Inc.

In <MOORE.92Dec18095153@defmacro.cs.utah.edu> moore@cs.utah.edu (Tim Moore) writes:

>In article <a_rubin.724526808@dn66> a_rubin@dsg4.dse.beckman.com (Arthur Rubin) writes:
>   >  2) The legality of PGP is not being seriously debated.  It's illegal. 
>   [...]
>     It may have some code
>   "contaminated" with some RSA code, in violation of copyright and/or trade
>   secret. 

>I have never seen this claim before.  Could you elaborate?   PKP
>alleges that Zimmerman may have stolen ideas from MailSafe because he
>had a copy in 1986, but that is extremely debatable (and Zimmerman
>denies it.)

That's what I was referring to.
--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Newsgroups: sci.crypt
From: weaver@kuttner.sfc.sony.com (Eric Weaver)
Subject:  PGP legality: letting it rest
Organization: SONY Advanced Video Technology Center San Jose, CA USA
Date: Sat, 19 Dec 1992 01:12:35 GMT


I would humbly submit that the amount of ethicizing and sanctimony on
the subject of the legality of PGP has exceeded all reason, that all
points have been made at least twice, and the level of discussion
now resembles the yowling of tomcats more than scientific or
even technological discussion.

All you people, take a chill pill.   Please.

ObCrypt:  Can anybody please abstract the meat of this Lucas article in Dobbs'?

-- 
Eric Weaver  Sony AVTC  677 River Oaks Pkwy, MS 35  SJ CA 95134  408 944-4904
& Chief Engineer, KFJC 89.7 Foothill College, Los Altos Hills CA 94022
Newsgroups: sci.crypt
From: mrr@scss3.cl.msu.edu (Mark Riordan)
Subject: RIPEM Distributors Wanted
Summary: I need your FTP site
Organization: Michigan State University
X-Newsreader: TIN [version 1.1 PL6]
Date: Sun, 13 Dec 92 02:59:01 GMT

Dear netters,

As many of you know, I have been working on an RSAREF-based email
public key encryption program named RIPEM.  RIPEM has been in beta test
for several months now, and it has (arguably) been ready for general
release for a while.  I have been waiting for administrators from a
local site to give permission to use that site for distributing an
official release of RIPEM.  While I still expect to get permission
eventually, the process is taking somewhat longer than expected.

Therefore, I am now seeking distribution sites for the impending
official release of RIPEM 1.0.

I would very much appreciate volunteers who will allow their site to be
used to distribute RIPEM and to run the public key server.  This would
entail running an FTP server, making a few additions to your Unix
machine's /etc/aliases file, and running a few server daemons.  To help
you comply with crypto export restrictions, I can provide either of two
FTP servers I have modified.  One attempts to restrict inbound
anonymous FTP users to sites in the United States and Canada.  The
other allows you to create special FTP guest accounts that require a
special username and password that can be used only from a particular
Internet node specific to that username.  If you choose this second,
more paranoid FTP server, I would be willing to administer the accounts
if you give me a Unix account on your machine.  (It doesn't have to be a
root account; these are special FTP-only ids being administered and not
Unix ids.)

Since we will be taking precautions to not export the software, and
since we have the explicit blessing of RSA Data Security, there would
seem to be little risk in distributing RIPEM.

If you have a "stable" machine and are willing to have it used to
distribute RIPEM and to run the key server, please contact me.

Thank you.

Mark Riordan    mrr@scss3.cl.msu.edu
Newsgroups: sci.crypt
From: phr@telebit.com (Paul Rubin)
Subject: Re: RSA questions
Organization: Telebit Corporation; Sunnyvale, CA, USA
Date: 17 Dec 92 22:19:07

In article <6gByVB5w164w@cellar.org> tsa@cellar.org (The Silent Assassin) writes:

   phr@telebit.com (Paul Rubin) writes:

   > RSA works like this:
   > 1. Pick two large primes p and q (with certain extra properties).
   > Let N=pq.

   What are the extra properties, and how large should they be to be reasonable
   secure?

This is the subject of a lot of research, but among other things
you want p and q both ==3 mod 4, and != 1 mod s.


   > 2. Pick random exponent s.  The pair (N, s) will be the public key.
   > 3. Compute secret key t, so that st = 1 mod (p-1)(q-1).  You can do
   >    this efficiently if you know p and q, but it is intractable otherwise.

   Huh?  1 mod x =x, correct?  That is. modulus is the remainder of integer
   division, and when you take 1 and mod it, you will always have a remainder
   equal to your original.   

"st = 1 mod (p-1)(q-1)" means when you multiply s by t and take
the remainder after dividing by (p-1)(q-1), you get 1.  The syntax
is different than the % operator in C.

Newsgroups: sci.crypt