HDTenEightyP/NetNews huggingface dataset:
From: pdc@dcs.ed.ac.uk (Paul Crowley)
Newsgroups: sci.crypt
Subject: Is there a single person here who agrees with David Sternlight?
Date: 13 Jan 93 03:22:08 GMT
Reply-To: pdc@dcs.ed.ac.uk (Paul Crowley)
Organization: Edinburgh University

I'm sorry, it got too much for me.  I could resist no longer.

Quoting strnlght@netcom.com (David Sternlight) in article <1993Jan11.002136.15202@netcom.com>:
>I invite others who don't wish to read messages from me for whatever
>reason to do the same. This will make their lives easier in that they
>won't have to send me complaints via e-mail, which I cannot honor
>since they are counterbalanced by the "keep up the good work"
>messages.

Quite apart from the irrelevance of such messages, I don't believe you. 
I'd really, genuinly like to see articles from anyone other than David
Sternlight who takes any part of his views on PGP and ITAR.
  __                                  _____
\/ o\ Paul Crowley   pdc@dcs.ed.ac.uk \\ //
/\__/ Trust me. I know what I'm doing. \X/
From: jim@rand.org (Jim Gillogly)
Newsgroups: sci.crypt
Subject: Re: Here's a challenge [how to crack]
Summary: simple substitution
Date: 12 Jan 93 18:39:33 GMT
Organization: Banzai Institute

In article <1993Jan12.095445.1@vax.sonoma.edu> gallaghe@vax.sonoma.edu (mycal) writes:
>OK now that we have seen the crypted and uncrypted text, naybe someone should
>post the encryption routine and how it was decrypted.  it might shed some
>light for us lesser skilled.

The thing's actually so easy that the only reason to talk about the
decryption is for the opportunity to repeat Frank L.  Lewis' dictum on
approaching an unknown cipher. <Look> at the thing, with your eyes rather
than programs, and see what's strange about it.  Ask yourself what could
cause that strangeness.

So uudecode the stuff and do an 'od' on it and see what you get:

0000000  f5ac 9c8a 8c9e d3df 9b9a 899a df8d 969c
0000020  9796 9a9b 9a8d 9adf 9693 df9c 9a8d 8b96
...
0000700  df9d 8a8d 909c 8d9e 8596 9ede dfbe 8d8d
0000720  9689 9a9b 9a8d 9c96 d1df f5f5 f5f5

The first thing that jumps out at you is that the high bit is on
everywhere.  Clearly this is going to be a very silly cipher.  For our
first trick, let's assume he's added some number to everything: a Caesar
cipher.  Try a quicky C program that subtracts all possible offsets from
the ciphertext.  No luck.  Try again using XOR instead of subtraction.
Aha -- at offset FF (hex) the whole thing falls out.  For the version I
posted, I stripped the high bit first, and didn't bother to get some of
the special characters, figuring that it was busted to the point of
clearly not being interesting.  The "real" decrypt is:

    Scusa, deve richiedere il certificato inscrizione al'univerita

    Perche` cose le serve il certificato

    Per rinviare di un anno, il servizio militare

    Deve presentare il domano scritta su un foglio di carta bollata

    He askes "When can I pick it up?"

    Alla fine del mese

    Ma scusa, perche` cose tardi? Non capisco proprio.

    In questo periodo, abbiamo molto lavoro da svolgere e` molte pratiche di
    finire

    Capisco. Non c`e niente da fare. E` la solita burocrazia! Arrivederci.

So the short answer is: flip all the bits in the plaintext and you get
the ciphertext.  And anybody who even looks at it sideways will get it
instantly.

-- 
	Jim Gillogly
	Sterday, 21 Afteryule S.R. 1993, 18:39
Newsgroups: sci.crypt
From: lcc@security.mitre.org (Lee C. Cooper)
Subject: DES board for the Macintosh ??
Organization: The Mitre Corp., Bedford, MA
Date: Mon, 11 Jan 1993 14:02:20 GMT


Does anyone know of any companies that make DES-based
boards/cards for the Macintosh?

Thanks in advance,

Lee Cooper
(lcc@mitre.org)


Newsgroups: sci.crypt
From: styri@hal.nta.no (Haakon Styri)
Subject: Re: KH-11 pictures (FLAMISH)
Followup-To: misc.misc
Reply-To: styri@nta.no
Organization: Norwegian Telecom Research
Date: Tue, 12 Jan 93 09:39:49 GMT

Please, tell the net all about spy satelites and planes. But I think
most of the `sci.crypt' readership would like you to move the discussion
to an appropriate newsgroup.

---
Haakon Styri
From: willmore@iastate.edu (David Willmore)
Newsgroups: sci.crypt
Subject: Re: KH-11 pictures -
Date: 13 Jan 93 01:19:05 GMT
Organization: Iowa State University, Ames IA

wright@lims01.lerc.nasa.gov (Ted Wright) writes:
>willmore@iastate.edu (David Willmore) writes:
>>There are a few differences.  The wavelength of the radio waves in
>>question are much longer than the light waves.  Therefore, the precision
>>with which the image receivers must be places is more stringent for the
>>optical methods.  It's just not too easy.  I'm not saying that it 
>>can't or isn't being done.  It's just difficult to accomplish.

>A few years ago on a television program (NOVA, I think) I saw something
>like this. Some people at the Jet Propulion Lab took a couple of digitized
>satellite pictures, crunched them in a computer for a while, and ended up
>with a 3D model of the subject area (San Francisco, I think) in their
>computer.

>They could "fly" around the city (between building, etc) and view
>objects from different perspectives. I don't think the were increasing
>the resolution, but they were extracting the 3rd dimension information
>from 2D images.  

I work at a GIS (geographic information systems) laboratory where we
work with data like this.  There is a comercial package called pv wave
which does this.  One of their demos takes several satellite pictures
from different angles and combines them to get a topography for the
area.  Given that, they map a set of luma (greyscales) values to the
topo yielding a 3D model of the city.  It's impressive to see a two year
old workstation rotate a 3D model of LA in real time. :)

I'm afraid that we've wondered afar, sorry.

--David Willmore
willmore@iastate.edu
Newsgroups: sci.crypt
From: smb@research.att.com (Steven Bellovin)
Subject: Re: Ciphers
Date: Mon, 4 Jan 1993 15:15:56 GMT
Organization: AT&T Bell Laboratories

In article <R90TwB1w165w@west.darkside.com>, sspy@west.darkside.com (mshannon) writes:
> Can anyone define pre and post whitening and differential cryptanalysis, 
> please?

Differential cryptanalysis works by feeding in pairs of inputs with
known exclusive-or values, and looking at the exclusive-ors of the
output pairs.  Except for the S-boxes, all the other steps in DES are
effectively constant over such operations.  The effect of the S-boxes
can be described probablistically.  By measuring the distribution of
the outputs from feeding in lots of input pairs, one can learn what
the input pairs' XOR value was, which in turn gives information on the
key bits.  (Yes, I know that I'm being quite unclear here.  Sorry, it's
the best I can do.)

> Someone stated that with a mass DES chip machine using brute force to 
> attack the DES, that the mode doesn't matter. Why even use it then? 
> Again, thanks in advance!

There are other attacks besides exhaustive search.  For example, with ECB
mode, occurences of the same plaintext on an 8-byte boundary will yield
the same ciphertext.  An opponent can build up a dictionary this way.
It's also much easier to mount cut-and-paste attacks on the *protocol*,
as opposed to the cipher, since each block is encrypted independently.
For more information, I suggest reading

@book{daviesprice,
   author = {Donald W. Davies and Wyn L. Price},
   edition = {second},
   publisher = {John Wiley \& Sons},
   title = {Security for Computer Networks},
   year = {1989}
}

and

@article{kent+voydock,
        author = {V.L. Voydock and S.T. Kent},
        title = {Security Mechanisms in High-Level Network Protocols},
        journal = {ACM Computing Surveys},
        volume = 15,
        number = 2,
        pages = {135--171},
        month = {June},
        year = 1983
}

Newsgroups: sci.crypt
From: rcain@netcom.com (Robert Cain)
Subject: Re: Anti-spoofing protocol?
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Mon, 4 Jan 1993 21:50:27 GMT

karn@servo.qualcomm.com (Phil Karn) writes:
: In article <1993Jan4.090057.20269@netcom.com> rcain@netcom.com (Robert Cain) writes:
: >
: >The problem of detecting a spoof in between two ends of a
: >Diffie-Hellman exchange is unsolved, as far as I know, using any known
: >protocol.
: 
: Why do you say that? You can detect the "ends against the middle"
: attack against DH if the parties sign their DH exchanges (using RSA or
: some other digital signature scheme) and verify them before using the
: DH-generated key to encrypt anything real.

This all assumes that you have a secure means of getting your public key
to the other or an authenticated one.  Both seem equivalent in the end
to swapping a secret key to me.  This makes me question the fundamentals
of PK actually.

: 
: The most I think an active attacker could do against this scheme is to
: trick the parties into revealing their public key certificates, if
: that matters.

Certificates, shmertificates. :-)

I have yet to see anything more than endless discussion on this.

Bob
-- 
Bob Cain    rcain@netcom.com   408-358-2007

    'The meek shall inherit the earth--the rest of us will move on..'
                                                    Sameer Parekh


               PGP 1.0 or 2.0 public key available on request.
From: pwd@Apple.com (Patrick W. P. Dirks)
Newsgroups: sci.crypt
Subject: Re: Privacy -- encrypt/decrypt devices on Wireless phones
Date: 5 Jan 93 02:33:18 GMT
Followup-To: sci.crypt
Organization: Apple Computer

In article <1hpsm7INNp2i@usenet.INS.CWRU.Edu>, bz223@cleveland.Freenet.Edu
(Danny Guy Frezza) wrote:
> 
> 
> 	I would like to ask, specifically, if anyone has information 
> concerning encrypting/decrypting wireless phones?  Someone mentioned in a
> recent post that Motorola has such a thing, but, how about AT&T or other
> big giants? Do they have any wireless phones that are "secure" or are 
> there any plans for it, on a wide-scale basis? I must say, that about a

This subject has been discussed in alt.scanner, and follow-ups may be more
appropriate there.  If I recall correctly, Motorola's "security" consists
of an analog frequency-inversion scheme (i.e. low tones are converted to
high tones and vice-versa around some center frequency).  No encryption,
and no real security.  Some of the newer 900 MHz cordless phones
appearantly use a spread-spectrum transmission scheme to communicate a
digitized data stream between the handset and the base unit so they are
harder to listen in on without special-purpose hardware: look at a recent
issue of "Popular Communications" - they reviewed two of the new models.

As other posters have pointed out, monitoring cordless phone links is *NOT*
illegal in the US.  I believe monitoring cellular phone calls is not
against the law, either, except that you cannot disclose the contents of
anything you monitor or use it for your own gain.  Congress recently passed
a bill that prohibits the sale of scanners that can receive (or be "easily
modified to receive") the 800 MHz cellular band.  That doesn't make
listening illegal, however, and doesn't remove existing scanners from the
market.

The real lesson, I'm afraid, is: don't expect *ANY* privacy on cordless or
cellular phones.  You stand a good chance of being disappointed if you do.

-Pat Dirks.
From: unruh@physics.ubc.ca (William Unruh)
Newsgroups: sci.crypt
Subject: Re: How fast is DES?
Date: 8 Jan 1993 19:02:46 GMT
Organization: The University of British Columbia
Distribution: world
NNTP-Posting-Host: physics.ubc.ca

ahaley@eoe.co.uk (Andrew Haley) writes:

>Using SDCRYPT, which is (still, AFAIK) the fastest DES implementation
>available on a PC results in:

And whee is SDCRYPT available?
Newsgroups: sci.crypt
From: robert.heuman@rose.com (robert heuman)
Subject: RSAREF and RIPEM
Organization: Rose Media Inc, Toronto, Ontario.
Date: Sun, 10 Jan 1993 04:03:58 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 01-09-93 22:56
In my previous message I discussed the reasons why if Lotus Notes were 
only available with a 40 bit key length outside of the US and Canada, 
and I were in a another country I could not buy the product and expose 
myself to industrial espionage, knowing that my US competitor was 
using a 'more secure' version.  I could not remember the legal term at 
the time, but to clarify, I was talking about DUE CARE.  This is a 
real problem with the export restrictions imposed by the US Govt re 
crypto in export versions of products, as losing a DUE CARE suit 
exposes not only the corporation but the directors themselves, who may 
not even be employed by the corporation.  They can be PERSONALLY 
liable.  It obviously depends on the laws of the particular country.

I welcome any comments on the application of DUE CARE to this 
discussion re the difference between the domestic and export versions 
of US software products, and specifically ask about the European 
attitude, in conjuction with the PRIVACY requirement imposed under 
both the EEC and other (local) laws re this subject.  International 
telecommunications of certain information I know cannot be 
accommodated, particularly to North America, because the US and Canada 
do not have laws re privacy that match the stringent European rules. 
Crpto is one method of providing privacy over communications that dare 
note be sent in the clear.  If one KNOWINGLY uses an export version of 
a US software package, is one exposed to a DUE CARE suit in Europe, if 
a stronger crypto implementation is available locally? 

BTW, Happy end of the first week back after the New Year, everyone :-)

Robert (Bob) Heuman <robert.heuman@rose.com>
---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RoseMail 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
Xref: sparky sci.crypt:6575 alt.security.pgp:477
From: zeke@fasttech.com (Bohdan Tashchuk)
Newsgroups: sci.crypt,alt.security.pgp
Subject: Re: Zimmermann's responses to Sidelnikov's PGP critique
Date: 9 Jan 93 05:10:46 GMT
Article-I.D.: fasttech.1993Jan9.051046.7367
Organization: Fast Technology   Beaverton, OR

In <1993Jan8.193153.4336@netcom.com> strnlght@netcom.com (David Sternlight) writes:

>Finally, I'd suggest extreme politeness in responding to Sidelnikov,
>and no little respect. Think of him as the Russian equivalent of
>Einstein in his field if it will help. In Soviet Science, Academicians
>are analogous to "the immortals".

I don't know Mr Sidelnikov personally. But the ex-S.U. wasn't exactly a
shining example of a meritocracy, especially at the higher levels.
So please, let's have a LITTLE less fawning in this forum.
(Or is this just an extension of your campaign to deprecate PGP?)
From: cf681@cleveland.freenet.edu (Brian Bodensteiner)
Subject: Re: FAQ/good resource
Newsgroups: sci.crypt
Organization: UCI
Date: 12 Jan 93 02:28:19 GMT
Followup-To: sci.crypt

In article <1993Jan11.210957.8578@linus.mitre.org>, hal@gateway.mitre.org
(Hal Feinstein) wrote:
> 
> 
> A good introductory book on cryptograhy is NIST special publication 800-2
> called Public-Key Cryptograhy" by James Nechvatal  April 1991

> The text is 162 pages long and is not an in-depth examination of these
> topics but a good introduction. Just right for the frequenctly asked
> beginner questions.

This sounds very interesting, and being a beginner, it sounds like just
what I am looking for. However, how do I go about getting a copy? A phone
or mail address would be nice. Thanx for recommending it.
Brian
From: jani.patokallio%acc1bbs@ssr.com (Jani Patokallio) 
Newsgroups: sci.crypt
Subject: Re: PGP - Legal?
Date: 4 Jan 93 19:04:00 GMT
Distribution: world
Organization: Advanced Computer Concepts BBS, New Rochelle, NY 914-654-1981
Reply-To: jani.patokallio%acc1bbs@ssr.com (Jani Patokallio) 

In message <1993Jan3.193639.1398#netcom.com> strnlght@netcom.com
(David Sternlight) said:
-> Jim Lynch says that if jano patokallio has diplomatic immunity he
-> can do anything.
-> 
-> Not without consequences. Though I make no comment about PGP, in
-> general he can be declared persona non grata and expelled. This
-> can have both personal and professional consequences.

Agreed.  Also, the laws of Finland and the US are basically similar,
the odds are that a crime here is a crime in Finland and I can be tried
there for it.

-> As to PGP, it is in the realm of possibility that if the U.S.
-> Government wished and knew about it, he can be accused of
-> espionage and expelled. 

It is also in the realm of possibility that a meteorite will crash
through my house right now, but it is rather unlikely.  I also doubt
very greatly that I would be expelled for a civil case.   However, one of 
my four questions was that if I have PGP imported from Europe, can I use it
legally in my house here?  (Which evidently is extraterritorial, thanks
David!)  If my persona, my belongings, and my communications are inviolable
according to international law, it would seem so.

-> If he is not an intelligence person this
-> can be quite damaging, and if he is and under cover, this will
-> "tag" him, making his cover useless in future in the U.S. and
-> in some other countries (if the U.S. has information sharing
-> arrangements with those countries).

If I was under cover I would not post about it on the net.  Besides,
to my knowledge the Finnish Government has not employed spies since
World War II.

--
Jani Patokallio                  |  "Ignorance is the soil in which belief
acc1bbs!jani.patokallio@ssr.com  |   in miracles grows."  -R. G. Ingersoll

---
 . AME 1.07 . 
               
Newsgroups: sci.crypt
From: Owen.Lewis@purplet.demon.co.uk (Owen Lewis)
Subject: Re: PGP - Legal?
Organization: FidoNet node 2:252/305 - The Purple Tentacle, Reading
Date: Tue, 5 Jan 1993 15:24:00 +0000

 -=> Quoting David Sternlight to All <=-


 >Espionage? For obtaining unclassified information that is very widely
 >and readily available to anyone in the US?

 DS> .......... There are some things, for example, which can readily
 DS> be seen from "unclassified territory" that are a violation of the
 DS> law to photograph. They are enumerated by general category in the 
 DS> Act.

 Tsk, tsk, David!

 What sort of red herring is 'unclassified territory'? What matters (in 
 context) is whether or not the subject or subject's activity is government 
 classified information that it is illegal to possess unless 
 specifically authorised to do so. Not even your spectacular sophistries 
 have yet conjured up Government classification for PGP. Come to think of 
 it.......I wonder why ever not??


___ Blue Wave/QWK v2.11
From: jwh@cs.bham.ac.uk (James Hawtin)
Newsgroups: sci.crypt
Subject: Re: sci.crypt.science
Date: 4 Jan 93 16:08:28 GMT
Reply-To: jwh@cs.bham.ac.uk
Organization: School of Computer Science, The University of Birmingham, UK

I agree with splitting the group.



			James.
Newsgroups: sci.crypt
From: an4729@anon.penet.fi
Subject: Phil's Dream (How-To?)
Organization: Anonymous contact service
X-Anonymously-To: sci.crypt
Date: Tue, 5 Jan 1993 17:21:36 GMT

I'm as eager as Phil Zimmerman to see encryption as the *standard* (rather
than the exception) for e-mail on the Internet...  but how can this goal be
attained?  Is such a move already "in the works"?  What needs to be done?
Can I help?
-------------------------------------------------------------------------
To find out more about the anon service, send mail to help@anon.penet.fi.
Due to the double-blind system, any replies to this message will be anonymized,
and an anonymous id will be allocated automatically. You have been warned.
Newsgroups: sci.crypt,alt.society.civil-liberty
From: greeny@top.cis.syr.edu (J. S. Greenfield)
Subject: Re: Question from someone who's new to all this
Organization: Syracuse University, CIS Dept.
Date: Mon, 4 Jan 93 14:56:37 EST

In article <bontchev.726158979@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:

>> How can someone (PKP) patent a mathematical algorithm?
>
>Well, they do not have patented the mathematical algorithm. They have
>pathented the usage of certain mathematical operation to implement a
>communication system. That is, anybody is free to use modular
>arithmetic in general, but usage of modular arithmetic for encrypted
>and/or authenticated communication is patented.

This sounds far too broad.  I would guess it's far more specific--somewhere
along the lines of use of modular exponentiation with a modulus
consisting of the product of two primes for cryptographic purposes.

Modular arithmetic was not at all new to cryptography when RSA was
developed, so the patent would *have* to be much narrower than just that.


-- 
J. S. Greenfield                                         greeny@top.cis.syr.edu
(I like to put 'greeny' here, 
but my d*mn system wants a 
*real* name!)                        "What's the difference between an orange?"
Newsgroups: sci.crypt,alt.security.ripem
From: rcain@netcom.com (Robert Cain)
Subject: Re: Nonlinear Amplification of Information
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Sun, 10 Jan 1993 19:47:13 GMT

markh@wimsey.bc.ca (Mark C. Henderson) writes:
: Well just be sure to include Mr. Cain on one of the lists of 
: "nasty" people you send to the president of RSADSI.  ;-)
: 

Not necessasary.  I have become friends with Mr. Bidzos and he is quite
aware of my use of PGP and my friendship with Phil.  People would be 
surprized at what a reasonable and friendly, if very tough, man he is.
The problem between RSA and Phil is very, very complicated and the way
it all came down it deserves to be if you hear both sides.

Bob
-- 
Bob Cain    rcain@netcom.com   408-358-2007

    'The meek shall inherit the earth--the rest of us will move on..'
                                                    Sameer Parekh


               PGP 1.0 or 2.0 public key available on request.
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: My book
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 11 Jan 1993 00:03:57 GMT


mshannon says:
"Someone suggested that I have "sold out to RSADS" because I have 
recommended MailSafe as the most user friendly program available for non 
programmers and engineers to use to secure their files. "

He should not be cowed by the ridiculous habit some have of
trying to discredit those who come to their own conclusions
by labelling it "selling out." This propaganda phrase from
the sixties is a nonsense, and those who use it reveal their
own inability to conduct a serious discussion.

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt