HDTenEightyP/NetNews huggingface dataset:
From: igb@fulcrum.co.uk (Ian G Batten)
Newsgroups: sci.crypt
Subject: Re: DES (Was: Re: 800MHz Trunked Radio System Signals)
Date: 31 Dec 92 14:18:30 GMT
Organization: Fulcrum Communications

In article <herman.725755696@phage> herman@nosc.mil (John W. Herman) writes:
> DES is certainly good eough for any application that does not interest
> a government.  If a government is interested in decrypting any information
> you have, you should consult a professional.  I have no idea how you might
> get in touch with one.

It is likely that there are corporations whose computing facilities and
staff skills are comparable to ``a government'' in this context.  As a
random example, given that (a) they developed it and (b) they have lots
of computers, IBM are probably as capable as the average government of
attacking DES.

This says neither that IBM can attack DES, nor that, if they have the
ability, that they have intention; merely that if attacks exist that
governments can carry out, then there are corporation who are placed
likewise.

[[ If you do want to ship secure data around, and are worried about
governments, generate a floppy disk full of random bits and convey a
copy to your correspondent.  XOR the shipped data and there you are.
You now have a key management problem, but an encryption problem. ]]

ian
Newsgroups: sci.crypt
From: cyoung@thor.ece.uc.edu (Christopher Young)
Subject: Re: sci.crypt.science
Organization: University of Cincinnati
Date: Wed, 30 Dec 1992 20:54:54 GMT

In article <1992Dec28.002054.25424@bernina.ethz.ch>, caronni@nessie.cs.id.ethz.ch (Germano Caronni) writes:
|> In article <Bzru3E.1I4@chinet.chi.il.us> schneier@chinet.chi.il.us (Bruce Schneier) writes:
|> >Anyone besides me sick of all the political discussions?  How about splitting
|> >this into sci.crypt.science and sci.crypt.politics?  Or booting all of the
|> >political talk to alt.security--and having someone moderate this newsgroup to
|> >ensure compliance?  My kill file is bulging.

	I think sci.crypt.science sounds redundant. How about sci.crypt.research and 
sci.crypt.politics?

|> 
|> I support the split. 
|> I do not support moderation...
|> 
|> 	gec
|> -- 
|> Instruments register only through things they're designed to register.
|> Space still contains infinite unknowns.
|> 
|> Germano Caronni    caronni@nessie.cs.id.ethz.ch

	The annoying cross posts is one of the reasons for moderation of a new group. 
One of the reasons against moderation is that some may like a "FREE" exchange of information.
I need to think more about the pros and cons of moderation before I voice my opinion.

-- 
-------------------------------------------------------------------------------
Christopher Young    				|	To those who don't
University of Cincinnati       			|	want to bear the cost
Department of Electrical & Computer Engineering |  	of changing society,
mail location 30				|	will bear the brunt
Cincinnati, OH. 45221				|	of the society they
(513)556-0904 					|	will not recognize.
						|
cyoung@thor.ece.uc.edu				|
-------------------------------------------------------------------------------
Xref: sparky sci.crypt:6037 alt.security.pgp:363
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: PKP/RSA comments on PGP legality
Date: 22 Dec 92 13:50:13 GMT
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Followup-To: alt.politics.usa.misc
Organization: Helsinki University of Technology, Finland

In article <1992Dec21.075152.13537@netcom.com>, strnlght@netcom (David Sternlight) writes:
>Jyrki (apt name) posts another anti-U.S. screed in which he says that
>I must have been referring to violence done by the U.S. government
>when I talk about lives lost or saved by cryptography during the war.

It was the most reasonable interpretation, though I had a hunch it was
not what you meant.

>I was not. I was talking about lives lost at Pearl Harbor, lives
>saved at Midway, and lives saved by Enigma and Purple decrypts, among many
>others.
>
>This is not the first time Jyrki has ignored the facts in order to flog
>his anti-American views, and it will doubtless not be the last.

Facts?  What facts?

If it's anti-anything, it's anti-US-gov-actions.  I don't like
governments aiming for totalitarianism especially when they're trying
to impose their worldviews on all of the world and it's a shame to see
so good a constitution being ignored.

You're right that it will probably not be the last time I voice my
opinion on this, but it will be the last time I'm directly commenting
on your articles, as you are now in my killfile.  Your articles -
though they have points once in a while - in general are just too much
noise to make them worthwhile reading.  Perhaps this will help you and
your need to take ad-hominem attacks on me will end.

Followups directed to alt.politics.usa.misc.

//Jyrki
Newsgroups: sci.crypt,alt.security.pgp
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Legal Stuff!
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 24 Dec 92 14:16:40 GMT

strnlght@netcom.com (David Sternlight) writes:

> I see no reason a rewritten U.S. PGP would be denied approval to modify
> RSAREF if they ask politely and with clean hands. I define clean
> hands as asking in a non-inflammatory way that doesn't arouse bad
> historical memories. For example, a request for a permission for
> a program called something other than PGP, but which is PGP file
> and protocol compatible, from someone other than Phil Zimmerman
> would be clearly non-inflammatory. That's not to say they wouldn't
> honor a request from Phil, but there are degrees of red flags
> here.

That's actually a good idea. Instead of discussing what RSA/PKP would
or would not do, could somebody (you?) ask that whether they will
allow the above? If somebody does it, could you please post the
results here?

> I am not interested in a discussion whose purpose is to make
> RSA wrong. What I am interested in is seeing a version of PGP
> in the U.S. that clearly doesn't violate either RSA's patents,

That would probably be in th interest of all US citizens, so maybe
some of them should really ask...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: palmer@icat.larc.nasa.gov (Michael T. Palmer)
Newsgroups: sci.crypt
Subject: Real question re DES vs IDEA cipher
Date: 24 Dec 1992 16:39:29 GMT
Organization: NASA Langley Research Center, Hampton, VA  USA
Distribution: world
NNTP-Posting-Host: icat.larc.nasa.gov
Originator: palmer@icat.larc.nasa.gov

I just read in the RIPEM FAQ that DES uses a key length that "should be
reasonably safe against an opponent smaller than a large corporation or
government agency."

Ack.

I don't get warm fuzzy feelings from this statement.  So...

What size key does IDEA use?  Is the length sufficient to stand up against
brute force attacks?  I mean, if you can brute force it then why bother
encrypting the session key with RSA (as in PGP and RIPEM)?  Nobody has to
worry about the public key stuff, they can just go right after the plain
text.

Since I've seen here that IDEA might end up in an update of RIPEM, I was
just wondering if it offered more security than DES (in CBC mode).  Please,
forgo the legal asides concerning the algorithms and respective export or
patent laws.  I'm just interested in what key sizes the different ciphers
use.

Thanks.

-- 
Michael T. Palmer, M/S 152, NASA Langley Research Center, Hampton, VA 23681
Voice: 804-864-2044,   FAX: 804-864-7793,   Email: m.t.palmer@larc.nasa.gov
RIPEM Public Key now available  --  Consider it an envelope for your e-mail
Newsgroups: sci.crypt,news.groups
From: marti@nugget.inf.ethz.ch (Robert Marti)
Subject: Re: More RSA questions
Organization: Dept. Informatik, Swiss Federal Institute of Technology (ETH), Zurich, CH
Date: Tue, 22 Dec 1992 16:23:54 GMT

In article <AfATsxL0Bwx2F93KFX@transarc.com>, Pat_Barron@transarc.com writes:
|> I was tinkering around with the RSA algorithm last night [...]
|> 
|> 1)  During the exponentiation, the numbers get *really* big.  Like, I
|> was shocked at how quickly they got big.  Is there any shortcut for
|> computing m^e mod n, without actually computing m^e first?

Yes.  Do the mod operations after each "round" (iteration or recursion)
in your exponentiation algorithm.  See procedure expmod in SICP (*),
page 47.


|> 2)  I chose the private key and public exponent by brute force.  Is
|> a better way to choose the private key than to factor (p-1)(q-1) and
|> choose something with no common factors?

Since factoring is _expensive_ for large (p-1)(q-1), you're better off
by generating a random integer e in some suitable range, say the range
of all the integers which have one digit less than (p-1)(q-1), and then
increment e until the gcd of e and (p-1)(q-1) is 1.  An implementation
of gcd can be found in SICP (*), page 44.

    SICP:  Structure and Interpretation of Computer Programs.
    By H. Abelson and G. Sussman.  MIT Press, 1985.

This is a great introductory book on computer programming.  It uses a
nice little Lisp dialect called Scheme. All Scheme implementations I
know support bignums, so you wouldn't even have to worry about the
size of your integers.

-- 
Robert Marti                    |  Phone:    +41 1 254 72 60
Informationssysteme             |  FAX:      +41 1 262 39 73
ETH-Zentrum                     |  E-Mail:   marti@inf.ethz.ch
CH-8092 Zurich, Switzerland     |
From: ahaley@eoe.co.uk (Andrew Haley)
Newsgroups: sci.crypt
Subject: Enigma, ULTRA
Date: 31 Dec 92 13:28:06 GMT
Organization: EO Europe Limited, Cambridge, UK
X-Newsreader: TIN [version 1.1 PL6]


Does anyone know of any technical description in the open literature
of the work done at Bletchley Park during WW2?  There doesn't seem to
be much information in Kahn's _Codebreakers_, but as that was
published in 1967 I'm not very surprised.

Andrew.
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP technical question (Not a flame)
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Tue, 22 Dec 1992 22:02:42 GMT


Suggested by Germano Caronni's message:

Wasn't it a Swiss firm, Hagelin AG, that (according to Bamford) sold
cryptographic devices for years while both cooperating with governmental
code breakers, and perhaps even knowing their system was broken?

I'm asking, not accusing, but it would be an amusing historical
footnote to IDEA being the product of a Swiss firm.

No reading between the lines, please. :-)

David
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Enigma and lives saved
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Thu, 24 Dec 1992 06:33:11 GMT


Right now, on A&E on cable on the West Coast, "Spies" is running
an episode on the Enigma, Bletcheley Park, Alan Turing, and the British
codebreakers.

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Opinions on RSA's RC2 and RC4?
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 23 Dec 92 11:51:44 GMT

karn@servo.qualcomm.com (Phil Karn) writes:

> >Does anyone have an opinion on the technical merits of RC2 and RC4?

> Yeah. If NSA will let them out of the country, then they can't be very
> good at all. It's as simple as that.

Hmm... I've heard (rumours, rumours...) that thre is an exportable
version of MailSafe, which is limited to 512 (or was it 540?) bit keys
(or was it moduli?)... Does that mean that NSA can factor such
numbers?... Would be a pretty serous advancement in mathematics, not
just in cryptography... It would also mean that they find cracking the
key easier than the other forms of attack... Could somebody in the USA
check that there is indeed an exportable version of MailSafe and see
what the max key size is?

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: MD5 as an encryption engine?
Date: 30 Dec 92 21:43:50 GMT
Distribution: sci
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com

In article <TODD.92Dec30124821@palomar.tivoli.com> todd@palomar.tivoli.com writes:
>Isn't it a simple matter to use an algorithm like MD5 to produce a
>very strong cipher?

Yes, it is, assuming MD5 is a one-way function.

>So why is MD5 exportable and why couldn't it be used as a replacement
>for DES?

Exponentiation is also exportable.  With it, you can make RSA -- and make
it as strong as you like by making the radix larger.

It's the code using MD5 or exponentiation which would be the encryption
code -- not the digest or exponentiation code itself.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
Newsgroups: sci.crypt
From: Marc_North@mindlink.bc.ca (Marc North)
Subject: Request for IDEA algorithm.
Organization: MIND LINK! - British Columbia, Canada
Date: Sat, 26 Dec 1992 06:40:11 GMT

Could someone please point to me where I can find the algorithm for IDEA
encryption? Better yet, email it to me ?? :)

Will post summary if requested to do so.

Many thanks,

Marc


--
Marc North  --  The Lanceholder's Group
Newsgroups: sci.crypt
From: pdh@netcom.com (Phil Howard )
Subject: Re: Any way to *CREATE* Vcr+ (VCR PLUS) codes??? (please read)
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Thu, 31 Dec 1992 03:15:52 GMT

jeremym@ravel.udel.edu (Jeremy A Moskowitz) writes:

>I was wondering - my cable listings dont provive codes for
>Comedy Central, channel 39. Drat. I always want to tape
>Mystery Science Theatre 3000 on Friday Evenings and
>Saturday Mornings.

I did once see a program posted for the reverse of what was requested.
However it did not produce correct results.  When I looked at the code
it was clear it was not even complete (although complete from the
compiler's point of view).

I would consider cracking VCR+ an interesting and challenging exercise.
I've noted some patterns in the codes in TV Guide and thought I would
give it a try sometime.  I've collected a few issues, including one week
from several areas so I can get a lot of channel diversity.  Some day I
may even get around to it.

In the mean time, I still program my VCRs the old way... I put in the
actual time and channel I want to record.
-- 
/************************************************************************\
| Phil Howard,  pdh@netcom.com,  KA9WGN    Spell protection?  "1(911)A1" |
| "It's not broken... it's just functionally challenged" --Phil and Pete |
\************************************************************************/
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: sci.crypt
Subject: Re: RSA Data Security Not
Date: 21 Dec 92 14:47:57 GMT
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg

robert.heuman@rose.com (robert heuman) writes:

> Incidently, the export controls also make it illegal to export 
> anti-virus shareware, but NOT illegal to export anti-virus 
> shrink-wrapped software sold over the counter (read them carefully to 
> find the exemption). Another example of silly rules.  F-PROT or the 
> McAfee suite of programs cannot be exported under these rules (F-PROT 
> originates in Iceland, so the author does not care about these US 
> rules) but CPAV, NAV and Untouchable can be exported. This makes about 
> as much sense as the rules re export of Crypto.  Anyway, SCAN and 
> CLEAN, etc., by McAfee are exported all over the world (or imported 
> at the other end), ignoring the rules.  Take the bull by the horns and 
> do the same for all of the Crypto material.

Ha, that's very interesting! Could you please provide the exact
quotations that rule out the anti-virus software exports as illegal?
Maybe it would be a good idea to cross-post to comp.virus too...

As to the export of "big" packages regardless the restrictions, well
we have here a perfectly legally bought copy of Norton Utilities 6.01,
which includes DES encryption of the hard disk and bears the sticker
"Not for export"... :-)

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Xref: sparky sci.crypt:6105 alt.security.pgp:392
From: mcbeeb@atlantis.CS.ORST.EDU (Brian Mcbee)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: PKP/RSA comments on PGP legality
Date: 23 Dec 92 06:33:46 GMT
Article-I.D.: leela.1h918aINNetv
Organization: Computer Science Outreach Services - Oregon State University
NNTP-Posting-Host: atlantis.cs.orst.edu

In article <1992Dec22.203159.23174@netcom.com> strnlght@netcom.com (David Sternlight) writes:

+In the U.S., I argue the law, since the issue is patents and that RSA
+has one, and that the Munitions act covers imports as well as exports.

If your intent is to warn us all that we might be breaking the law,
consider us warned.  Personally, until I hear from a disinterested
attorney with expertise in this field, or until I see a conviction in
a court of law, I'm not convinced.  But I have been warned.  Can we get
on with it?

+In Europe, where I have never argued RSA's patents apply, and I have
+never argued the U.S. Munitions laws apply, I argue the ethics of
+taking an invention without compensation.  Like most such discussions
+here, these arguments have evolved as we learn from each other. That
+argument also applies in the U.S.

If you really are arguing a moral stand, perhaps you can explain why
at the end of 17 years (or whatever the protection is for patents),
your moral and ethical obligation suddenly disappears?

+Thus I suggest for Vesselin's (and others') consideration that they
+may be violating the laws of the countries they are in by using PGP
+without (for example) getting permission from the appropriate
+Minister, as in France. If true, that would make all the posturing
+about how the U.S. Munitions laws don't apply to Europe and hence PGP
+is o.k. completely bogus.

+In the case of Vesselin, specifically, I suggest he check out
+the German crypto and Munitions laws, since that's where he
+apparently has PGP on a computer. If he's planning to use it
+in Bulgaria, he may also wish to check out those laws.

+David

I see, now you are a shill for governments world-wide.  Don't you 
have any interests of your own to watch out for? 
Newsgroups: sci.crypt,alt.security.pgp,alt.security.ripem
From: hrubin@mentor.cc.purdue.edu (Herman Rubin)
Subject: Re: Legal Stuff!
Organization: Purdue University Statistics Department
Date: Sat, 26 Dec 1992 13:00:06 GMT

In article <1992Dec26.110116.1258@netcom.com> strnlght@netcom.com (David Sternlight) writes:

>Steve Gardner writes:
>"Imagine having to pay Newton for the 
>        algorithm for calculating the derivative of a polynomial."

>Actually, Sir R.A. Fisher did something somewhat analogous to that
>(the publication/ academic equivalent). He invented the method of
>maximum likelihood, a powerful general method for deriving all sorts
>of statistical tests, and kept it a secret. He then derived one test
>after another, published each one separately in the journals, and got
>payment for each usage of the method, in effect, in the form of kudos
>if not money.

This is the utter nonsense put out by the admirers of Sir Ronald who
keep blissfully unaware of what everyone else knew and did.  I do not
doubt that he rediscovered maximum likelihood, and that mathematical
statistic was in the doldrums at that time, but there were those who
knew the at least century old method, and were using it quietly.

He wrote mainly in journals not read by those with mathematical knowledge,
and especially by the few who were aware of what had been done to apply
mathematics to statistical analysis at the time.

RSA may seem miraculous to those who do not know mathematics, but not to
those who do; I suspect the Patent Office to be staffed by those in the
former class.  A BS in mathematics does not mean knowing much, if any,
non-computational mathematics, and certainly not the number theory and
knowledge of computational complexity needed to appreciate what has been
done by the promoters.  As a professor for a long time, I must question if
many are really "skilled in the art", as the patent laws put it.
-- 
Herman Rubin, Dept. of Statistics, Purdue Univ., West Lafayette IN47907-1399
Phone: (317)494-6054
hrubin@snap.stat.purdue.edu (Internet, bitnet)  
{purdue,pur-ee}!snap.stat!hrubin(UUCP)
Newsgroups: sci.crypt
From: rdippold@cancun.qualcomm.com (Ron Dippold)
Subject: Word Perfect Cracker Source
Organization: Qualcomm, Inc., San Diego, CA
Date: Mon, 21 Dec 1992 18:55:52 GMT

I've already released the source code for my Word Perfect password
cracker / decrypter to the public domain, but it's hard to find, and
I've had lots of email requests, so I figured I'd just post it here.
Is that appropriate, or should I use one of the sources groups?

-- 
"Forfeit everything you have, and join us 'cause you're Powermad!"
Newsgroups: sci.crypt