HDTenEightyP/NetNews huggingface dataset:
From: bs@gauss.mitre.org (Robert D. Silverman)
Newsgroups: sci.crypt
Subject: Re: RSA-129 contest
Date: 22 Aug 92 11:32:06 GMT
Organization: Research Computer Facility, MITRE Corporation, Bedford, MA

In article <8146.Aug2205.17.2492@virtualnews.nyu.edu> brnstnd@nyu.edu (D. J. Bernstein) writes:
 
stuff deleted...

>If you feel that way, don't participate. Other people have submitted
>good polynomials and I'm sure the current record won't last long. Nobody
>knows an ``accurate figure of merit'' for GNFS polynomials: nobody has
>ever exhibited an accurate method of estimating how much time GNFS will
>use with various parameters, though GNFS detractors always seem to
>pretend otherwise.
 
Too bad you were not at the public-key crypto conference in Oberwolfach
last year. I presented the results of quite a few benchmarks for the
sieving phase of GNFS on general numbers ranging from 30 to 90 digits.
I would characterize this as an accurate way of estimating how much
time GNFS will take, wouldn't you? I also have at least an order of
magnitude more data than anyone else on the performance of the quadratic
sieve. From this data it is not difficult to project a crossover point
of around 135 digits. The data I have also shows how much speedup is
obtained by reducing the size of the coefficients. My data says that
you will need to find 14 digit coefficients for GNFS to compete with
PPMPQS in doing RSA-129.
 
But Dan says he does not believe this 'pessimistic estimate'.

I am not 'pretending' anything, despite Dan's insults. I have real
data.   Dan's labelling of detractors as 'pretending' is both insulting
and unprofessional.
 
Of course he can't back up this belief, because he doesn't have
enough data on the performance of both methods. Of course he is
now obtaining data on the sieving part of GNFS now that he has
it coded. But he still lacks data on QS. Lenstra and Manasse have
done a few dozen numbers with QS. I've done in excess of 500.

I am also curious as to whether his comparison with QS also considers
the time to do the final square root along with the sieve time? He
reported that for 2,488+, the final square root took about 15% of the
total sieve time. [1 day vs. 6 days]
--
Bob Silverman
These are my opinions and not MITRE's.
Mitre Corporation, Bedford, MA 01730
"You can lead a horse's ass to knowledge, but you can't make him think"
From: Marc.Ringuette@daisy.learning.cs.cmu.edu
Newsgroups: sci.crypt
Subject: Re: Secure netnews
Date: 19 Aug 92 19:10:00 GMT
Article-I.D.: news.9208191946.AA17295
Organization: The Ohio State University Department of Computer and Information Science

a_rubin@dsg4.dse.beckman.com (Arthur Rubin) writes,
> Actually, if the "signatures" are cryptographic, there may be a
> solution to that.  You have to define "subscribers" as key-holders
> rather than as machines, but it seems somewhat reasonable.

Sorry, I thought that was clear.  Each participating machine has a
public key and the ability to sign messages.

>>Worse, there is no way for any machine even to know that it has a complete
>>or accurate list of subscribers because there is no way to distribute
>>such a list in a trusted manner.
>
>That's true.

That's NOT true, once the secure newsgroup exists: the list of
participating machines can be posted to the newsgroup!  :-O

The list can be amended as time goes on (with each amendment, naturally,
signed by a plurality of the participating machines in order to be valid).
You can verify the entire sequence of such amendments, starting with the
Founding Fathers and ending with the current state of affairs.  If you
haven't been around since the dawn of time, just make sure that the
signatures of some machines you trust, or a whole lot of prominent people,
are attached to the list.

----

I haven't seen much comment yet.  I was expecting, at least, something about
the pros and cons of using a distributed voting protocol to establish a
global consensus.

Does anyone have anything to add, or are you all stunned into silence by the
brilliance of my proposal?  ;-)


M.
Organization: Queen's University at Kingston
Date: Thursday, 13 Aug 1992 13:40:45 EDT
From: <GRIBBLEP@QUCDN.QueensU.CA>
Newsgroups: sci.crypt
Subject: Re: WANTED: Mac program and/or (any) source on DES and/or RSA

I am interested in writing a small encryption/decryption program (not for
commercial release - for my own use) that uses RSA and/or DES.  Can anyone
direct me to good sources of information that would enable me to implement
these techniques from scratch?  (high level descriptions of the techniques
aren't terribly useful, but they will do if you know of no other sources).
Thanks in advance,
Paul
P.S. you can reply directly to me or to here.......
Newsgroups: sci.crypt
From: louie@sayshell.umd.edu (Louis A. Mamakos)
Subject: Re: translators at NSA
Organization: University of Maryland College Park
Date: Tue, 18 Aug 1992 13:43:25 GMT

In article <Bt5KAH.M73@world.std.com> ariel@world.std.com (Robert L Ullmann) writes:
>Hi,
>
>More likely, NSA wants language experts to translate papers
>on (e.g.) cryptography from open sources that are not otherwise
>accessible to their experts whom, as you point out, are trained
>in other fields, and not necessarily fluent in the requisite
>languages.

I think this discussion is missing probably the most obvious use of
foreign language translators.. translating voice intercepts!  Not all
communication is done digitally.  People use phones and radios all
over the world.

I grew up and went to high school very close to NSA.  In fact, my
junior high school was on Fort Meade, and our bus used to ride through
their parking lot every day.  They are one of the larger employers of
foreign language majors out of school in the area.

They've also got thie really cool building that we got to watch being
built which has looks to have a copper conductive surface.  I guess if
you build a tempest building, you can buy cheaper hardware to put IN
the building!

louie
From: paul@kuhub.cc.ukans.edu
Newsgroups: sci.crypt
Subject: ATM Writ - Proof and courts action
Date: 21 Aug 92 10:28:40 CDT
Organization: University of Kansas Academic Computing Services

> Subj:	RE: Automatic Teller Machine Writ
> 
> I'd like to provoke discussion which would clarify the requirements for
> such a facility.
> 
> Clearly it would be some kind of court and would have to have some
> technical competence too. What more would be needed?

Ideas expressed in the "Scientific American" August article about such
things are a registration authority that certifies that X is a person
and that Y is a corporation. The registration authority would "sign"
that certification for all to use.
 
> The naive idea is that I want to get from it a declaration that `Bloogs
> Mail Order Inc., Registered Office so-and-so, did on the xth day of y
> sign message z to the plaintiff'.

And message z, along with the message's authentication information,
would be stored in plaintiff's tamper proof smart card. Plaintiff
could release said message to court for proof.
 
> If you go that far then why not add the ability to order `and is found
> liable to pay the plaintiff the sum of w'.

Since plaintiff's card is tamper proof and can either present or not
present message z therein lies the "proof". Liability would be left in
the court's jurisdiction.
 
> Can one go that far without getting involved in the whole morass of
> procedural complexity, cost, and the other negative factors of a court
> as opposed to an arbitration?
> 
> Should we try and redesign courts for contract litigation in the electronic
> age? Or is it better to rely on arbitration agreements? In the latter case
> how do you stop powerful players (such as industry groups) setting up
> arbitration processes which are against the customer's interest (such as
> the UK banking ombudsman scheme)?
> 
> Questions to the net, please, and let's get this going ...
> 
> Ross
Newsgroups: sci.crypt
Subject: Re: Secure netnews
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 19 Aug 92 16:37:22 GMT

In <1992Aug18.221506.13535@Princeton.EDU> dla@raven (Don Alvarez) writes:

>In article <9208182108.AA09132@news.cis.ohio-state.edu> Marc.Ringuette@daisy.learning.cs.cmu.edu writes:
>>
>>The basic technique I propose in order to achieve this is a two-stage news
>>distribution process, where first the news is distributed to the entire set
>>of receiving machines, then signatures are collected from all receivers and
>>distributed in the same way as a regular news article.  
>>
>>Machines must register themselves by posting to the newsgroup, and must agree
>>to respond to signature requests within a reasonable window, or they will be
>>removed from the set of participating hosts.  
>>
>>What do you think?  See any gaping holes?  Want to flesh it out and 
>>give it a try?
>>
>>    --Marc Ringuette, mnr@cs.cmu.edu

>Gaping holes?  *YES*

>There is no central authentication server, so every subscriber must be
>able to determine authentication themselves.  That means every
>subscriber needs a list of the names of all of the other subscribers.

>Any subscriber can fraudulently "authenticate" any posting simply by
>greping through the list of subscribers and announcing "subscriber foo
>received article 754", "subscriber bar received article 754", etc.

Actually, if the "signatures" are cryptographic, there may be a solution to that.
You have to define "subscribers" as key-holders rather than as machines,
but it seems somewhat reasonable.

...

>Worse, there is no way for any machine even to know that it has a complete
>or accurate list of subscribers because there is no way to distribute
>such a list in a trusted manner.

That's true.

>Providing a centralized server for doing the authentication wouldn't
>help, because there is no way for it to know who is sending the
>subscription messages or who is sending the receipt messages.  There
>would also be no way for the individual subscribers to know who sent
>the "article 754 authenticated" message.

That's not correct.  If you believe public key signature systems can be
secure, then a message can be posted which has the effect that "someone
with key K1 posted message M1".


--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; if you want to be sure I see a post, mail it.
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: Cryptographic voting
Organization: Chinet - Public Access UNIX
Date: Fri, 21 Aug 1992 06:28:52 GMT

In article <9208162214.AA21945@news.cis.ohio-state.edu> Marc.Ringuette@daisy.learning.cs.cmu.edu writes:
>A recent newswire article about suggestions to allow telephone voting
>got me thinking about the possibility of running a cryptographically
>secure presidential election via email.  I claim that the problem is
>very similar to the problem of untraceable electronic cash, and that
>with a little work, we could concoct a secure protocol for running
>national elections by email, using known technology.
>
>I made this claim on a local newsgroup, and a colleague, Doug Tygar, 
There is a secure voting protocol in _Security_in_Computing_, by Charles
Pfleeger (Prentice Hall, 1989), pages 144-145.  As written, the protocol
has a problem but it can be fixed.

Bruce


****************************************************************************
* Bruce Schneier
* Counterpane Systems         For a good prime, call 391581 * 2^216193 - 1
* schneier@chinet.chi.il.us
****************************************************************************
Newsgroups: sci.crypt
From: lewis@aera8700.mitre.org (Keith Lewis)
Subject: Re: Public Key & MS-DOS
Organization: The MITRE Corporation
Date: Wed, 19 Aug 1992 17:24:52 GMT

In article <1465900005@igc.apc.org>, Dan Yurman <dyurman@igc.apc.org> writes:
>
>I would appreciate pointers to books which explain how to
>understand public key / private key systems.  Also, I would
>appreciate pointers to any MS-DOS implementations either as
>shareware or commercial products.  As you can tell, I am
>new to this field so elementary sources are better. Thanks.

PGP, a derivative of the RSA public key system, is available for anonymous
ftp from gatekeeper.dec.com under the /pub/micros/msdos/pgp directory.
The documentation included (pgpguide.lst) with it is a good introduction to
public key systems (RSA in particular).

If you want to get into the mathematics of one-way functions, I suggest the
article "The Mathematics of Public Key Cryptography", by Martin E. Hellman,
_Scientific American_ (August 1978?).  There was also a "Mathematical Games"
column (by Martin Gardner) in 1977 or 1978 that dealt with the subject.

Keith Lewis             klewis@mitre.org          "Mr. Cheap"
I don't dance to music; music dances to me.  Email me for my PGP key.
The above may not (yet) represent the opinions of my employer.
From: brnstnd@nyu.edu (D. J. Bernstein)
Newsgroups: sci.crypt
Subject: Re: RSA-129 contest
Date: 21 Aug 92 23:30:15 GMT
Organization: IR

In article <9208200145.AA29470@ucbvax.Berkeley.EDU> jbs@WATSON.IBM.COM writes:
> What is the point of this contest?

To find a good polynomial for RSA-129.

To factor RSA-129 with GNFS would take many hundreds or thousands of
MIPS-years with a random polynomial. In the two weeks since the contest
was announced, quite a few people have submitted polynomials, and the
best so far---yours---is roughly 1000 times better than random.

That means *three times less work* for GNFS. That is a huge difference.

Polynomials another 10 or 20 times better could well be good enough for
GNFS to complete in a reasonable time. There are also algebraic criteria
which give some polynomials a significant ``boost.'' For instance, a
polynomial which has many roots modulo 3, 5, and 7 is nearly 100 times
better than a polynomial which has no roots modulo 3, 5, or 7, all else
being equal. (Most polynomials are somewhere in the middle.)

Keep in mind that f(m) doesn't have to equal n---it be any positive
multiple. So there are a huge number of polynomials to search through.
Someone who uses clever techniques to search through selected m's may
have a better chance of finding a good polynomial than someone who runs
through billions of m's by brute force (though brute force never
hurts!). It may also be possible to use the extra structure of
two-variable polynomials f(m_1,m_2) to obtain better results there---
certainly the optimal two-variable polynomials have much smaller
coefficients than the optimal one-variable polynomials. These are open
problems. Nobody knows what the best way to search for polynomials is.

In any case, the polynomial-searching contest has produced spectacular
results so far. Keep those submissions coming in! I'm sorry I don't yet
have precise estimates of exactly how much RSA-129 GNFS time is saved by
any particular polynomial, but I can assure you that a few weeks of
polynomial searching will be time very, very well spent.

---Dan
Newsgroups: sci.crypt
From: ariel@world.std.com (Robert L Ullmann)
Subject: Re: translators at NSA
Organization: The World in Boston
Date: Tue, 18 Aug 1992 00:06:16 GMT

Hi,

More likely, NSA wants language experts to translate papers
on (e.g.) cryptography from open sources that are not otherwise
accessible to their experts whom, as you point out, are trained
in other fields, and not necessarily fluent in the requisite
languages.

Note that one attribute of the NSA is that they are charged
with knowing and monitoring *everything* in their field. If a paper
is published in Tamil about some odd mathematical theory, making
that paper available to their researchers is an imperative.

Rob
--
Robert Ullmann		Ariel@World.STD.COM	+1 508 879 6994 x226
Quand Maigret poussa la porte du Tabac Fontaine, vers une heure et demie,
le patron du bar, qui venait de se lever, descendait lentement un escalier
en colimaon qui s'amorait dans l'arrire-salle. ... Arriv derrire le
comptoir, il repousa le garon d'un geste ngligent de la main, saisit
une bouteille de vin blanc, un verre, mlangea au vin d l'eau minrale et,
la tte renverse en arrire, se gargarisa.  -- Simenon
Newsgroups: sci.crypt
Subject: Thoughts on using a one-way hash function as a cipher
From: pgut1@cs.aukuni.ac.nz (Peter Gutmann)
Date: Wed, 19 Aug 1992 07:22:00 GMT
Organization: HPACK Conspiracy Secret Laboratory

A week or so ago I posted code for turning any one-way hash function into a CFB
encryption algorithm.  I've looked at it a bit more, and made a few
improvements (as well as fixing a bug in the original code).  To recap, the
cipher used MD5 as its one-way function, with the resulting algorithm being
called MDC.  The output of MDC was made key-dependant by replacing the
predefined Mysterious Values with ones derived from a user-supplied key.

I believe that using a one-way hash function in this manner makes more sense
than using a true cipher since, when used in CFB mode, the cipher is simply
acting as a hash function anyway.

The transformation is in fact somewhat more complex than this, since MD5 uses
both the 'input' and 'output' data in its transformation, and reduces 64 bytes
of input to 16 bytes of output.  It works as follows:

      in[ 64 ] + out[ 16 ] -> out'[ 16 ]
	data    previous MD   current MD

This problem is resolved by initially setting out[ 16 ] to the IV, and in[ 64 ]
to zeroes.  Then, once the MDC constants have been set, we set in[ 64 ] to
values derived from the key.  This means that even chosen plaintext attacks can
only resolve 16 of 80 bytes of input.  Thus the best attack possible is a
20%-chosen plaintext attack (128 bits known, 512 bits unknown).  What we are
doing is as follows (for a chosen-plaintext attack):

       [ 16 bytes ]  +  [ -------- 64 bytes -------- ]

	16 bytes -         64 bytes - derived from
	 chosen           encryption key and unknown
      
			|       |
		    +---------------+
		    |               |
		    |      MDC      |   Unknown one-way transformation
		    |               |
		    +---------------+
			|       |
			\       /
			  \   /
			    v

		      [ 16 bytes ]
		 
		       16 bytes -
			 known

We are transforming a 640-bit input value of which 128 bits are known, to a
128-bit output value via the MDC tranformation, a one-way hash function which
is controlled by a user-supplied key.

In fact, this can be refined even further by using in[ 64 ] as the key, and
repeatedly transforming out[ 16 ] to out'[ 16 ] with it (with the initial
setting of out[ 16 ] being the IV value).

Thus we have two possibilities (with chosen-ciphertext attack shown below):

    in[ 64 ] + out[ 16 ] --MDC--> out'[ 16 ]
    unknown     chosen   unknown    known

and

    in[ 64 ] + out[ 16 ] --MD5--> out'[ 16 ]
    unknown     chosen    known     known

Question:  Is the use of the unknown-transformation MDC necessary?  In other
words, do the 64 unknown bytes used with the known-transformation MD5 give
enough security?  If they do, this has interesting possibilities, since MD5 is
a MAC system and therefore not covered by the ITAR restrictions....

Comments, flames, etc to pgut1@cs.aukuni.ac.nz.
From: segr@nessie.mcc.ac.uk (Simon Read)
Newsgroups: sci.crypt
Subject: Trying to reach Mark Johnson
Date: 18 Aug 92 11:58:33 GMT
Organization: Manchester Computing Centre

Mark,

You mailed me but my reply bounced. Can you give me an alternate box to the
netcom.com address I've got?

Mail me at Simon.Read@umist.ac.uk.

Simon Read
Newsgroups: sci.crypt
From: tlimonce@drew.drew.edu (Tom Limoncelli)
Subject: Re: Secure netnews
Summary: Oh nothing important.  I just have this Perl script that I use to generate this stream of posts whenever someone posts the silly suggestion that netnews could be made secure.
Keywords: silly automated
Organization: Drew University - Alumni
Date: Wed, 19 Aug 1992 23:15:47 GMT

In <f10@Warren.MENTORG.COM> tal@Warren.MENTORG.COM (Tom Limoncelli) writes:

> And, since all Usenet flame wars ultimately evolve to a prediction of
> The End Of The Net or a comparison to Hitler, we can concluded that
> this flame has reached its ultimate status.  And therefore, it has
> reached its natural conclusion.

But Tom forgot that flame wars never end on Usenet.  In fact, this
would be about the time that Peter da Silva would chime in with
a bit of truth like:

"Then do it. Design and implement secure news. Since TCP isn't entirely
secure, you'll have to add some authentication protocol on top of that.
Since UUCP is spoofable, you'll need to use it there as well. It's not
going to be easy.
 
"If it works we'll all switch over. If it doesn't we'll have learned
something.
 
"But you can't get there from here."

Doesn't that sound just like him?


Tom
--
There is nothing wrong with talking to yourself...
I met an interesting person that way!
-- 
Tom Limoncelli -- tal@warren.mentorg.com (work) -- tal@plts.uucp (play)
"Oh! I thought it was one of those useless demos of everything that
    a GUI builder could do." -Anonymous person watching demo of
         Solaris 2.0's graphical tool for managing NIS+
Newsgroups: sci.crypt
From: bs@faron.mitre.org (Robert D. Silverman)
Subject: Re: PD public key system
Organization: Research Computer Facility, MITRE Corporation, Bedford, MA
Date: Sun, 16 Aug 1992 21:06:50 GMT

In article <1992Aug16.174133.20172@ole.cdac.com> ray@ole.cdac.com (Ray Berry) writes:
:rjones@itchy.dsd.es.com (Ray Jones - Perp) writes:
:
:(description deleted...)
:
:>Any suggestions?  Is it true I can't use RSA?  Is there a scheme that would
:>work for the above and that I could also distribute?
:
:	Some time ago Next Inc. announced their intentions to use a scheme termed
:"elliptical descent" for public key security.  I'm not qualified to comment
:on its applicability or security - perhaps others here can do so.  I don't
 
It uses the word problem for Mordell-Weil groups. i.e. it is equivalent
to the discrete log problem over finite fields, but instead uses groups
defined on elliptic curves over finite fields.

The difference between this and ordinary discrete logs is that this
method does not seem to be susceptible to Coppersmith's techniques
for fields of characteristic 2, and index calculus based attacks seem
more difficult as well.
 
I suggest you check the literature for references on discrete logs.
I am at home and all of mine are at my office. In particular, pay
close attention to papers by Dan Gordon on elliptic discrete logs and
any by Odlyzko or Coppersmith.

--
Bob Silverman
These are my opinions and not MITRE's.
Mitre Corporation, Bedford, MA 01730
"You can lead a horse's ass to knowledge, but you can't make him think"
Newsgroups: sci.crypt