HDTenEightyP/NetNews huggingface dataset:
From: markh@csd4.csd.uwm.edu (Mark)
Subject: Re: DES source code for Aliens
Organization: Computing Services Division, University of Wisconsin - Milwaukee
Date: Fri, 4 Sep 1992 09:35:34 GMT

In article <1992Aug29.214902.27422@cbnewsh.cb.att.com> wcs@cbnewsh.cb.att.com (Bill Stewart 908-949-0705 erebus.att.com!wcs) writes:
>(Of course, the way the War On Politically Incorrect Drugs is going,
>privacy-protection software may soon be declared an "Assault Weapon",
>but that's a rant for alt.conspiracy :-)

What may or may not be done in this matter is irrelevant.  There is an
encryption method which will generate English output from any arbitrary clear
text.  So how would anyone ever know such and such file is an encrypted file?

Second, I could write a general purpose file utility which has no explicit
encryption capibility in it, but which can be caused by the user to act like
an encryption program.  Any binary editor satisfies that criterion.  All the
user has to do in this extreme example is do the encryption by hand using the
editor.  A more elaborate editor will assist the user in this process and
speed things up, but will still be a general purpose file utility.  A still
more elaborate file utility will automate almost all the process, but will
still be a general purpose file utility and will require just a little push
from the user to do encryption.

No law can draw the line.  Therefore no law can exist.
From: segr@nessie.mcc.ac.uk (Simon Read)
Newsgroups: sci.crypt
Subject: GCHQ's location.
Date: 28 Aug 92 15:02:46 GMT
Organization: Manchester Computing Centre

No big secret!

GCHQ is near Cheltenham. It's an enormous group of buildings,
shouldn't be hard to find. I think there are even signposts.

Bletchley Park is a stately home, I think, I've always assumed
that it was near Bletchley, Bucks. But perhaps that's too simple.
Bletchley Park was the wartime codebreaking centre, AM Turing and
all that. Hasn't it become the headquarters of the IBM research
division?

Cheltenham is about halfway between Bristol and Birmingham (i.e.
on the left hand side of mainland Britain). Bletchley, Bucks.
is about 40 miles North of London (i.e. it would be on the right
hand side of Britain if it didn't bulge out so much on the
right). I suppose the distance between them is only about 40
miles, but that's a long way on this tiny Isalnd of ours.

I wouldn't have thought there would be a museum on the site at
Cheltenham. I haven't heard of a crypto museum in Britain. If
anyone can put me right I'd like to know. I would be fascinating
to go.
Newsgroups: sci.crypt
From: schow@bqneh23.bnr.ca (Stanley T.H. Chow)
Subject: Re: User authentication
Organization: Bell Northern Research Ltd, Ottawa
Date: Tue, 1 Sep 1992 19:40:45 GMT

In article <6069@transfer.stratus.com> cme@ellisun.sw.stratus.com (Carl Ellison) writes:
>In article <1992Aug31.135512.16204@sniap.mchp.sni.de> frank@D012S436.sniap.mchp.sni.de writes:
>>: Your account is named by your public key -- not by some silly collection
>>: of letters, such as "IBM".
>>
>>Don't be silly, we have no public key accounts just yet - I'm
>>delivering you the VERY FIRST KEY FOR IBM.
>
>
>If there are no public key accounts, then you can't be delivering a public
>key.  To deliver the public key, you need a bank willing to take public
>keys.  That means there are accounts.  Once there are accounts, any
>deposits into them will have to be made with the public key.
>
>Such accounts have nothing to do with any non-public-key accounts which any
>corporation might or might not have in any other bank.
>
>And, as I said, once you have a public key account, I don't care what
>pronounceable name you use.  I (the bank) will ignore it.  The only thing
>which matters is the public key.

--------------------

Lost Key alert:

It has come to our attention that our private key has been
lost. Please stop using the old public key at once and use this
new key instead "&*(413nmlfs09uln1143".

CEO of IBM

----------------------
 
Can I now transfer some money?



--
Stanley Chow            InterNet: schow@BNR.CA
Bell Northern Research  UUCP:     ..!uunet!bnrgate!bqneh3!schow
(613) 763-2831
Me? Represent other people? Don't make them laugh so hard.
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: quality of hash (was: SHS/SHA source code...)
Keywords: SHS SHA message digest
Date: 4 Sep 92 14:20:36 GMT
Organization: Stratus Computer, Software Engineering

In article <1992Sep4.060230.28313@cs.aukuni.ac.nz> Peter Gutmann (pgut1@cs.aukuni.ac.nz) writes:
		[...]
>This means that
>instead of reusing the input data in each group of rounds, SHA uses different
>permutations of the input data in each group of rounds.  This is definitely A
>Good Thing.
		[...]
>Which is stronger, MD5 with its improved bit-bashing or SHA with it's 'expand'
>transformation?  (Ain't no way I'm going to answer this one :-).

I'm not writing to flame Peter.  This is a genuine question for me.


How do we know A Good Thing when we see it?

We know that hash functions are supposed to be 1-way.

Does anyone have a function for evaluating how much more an algorithm
approaches 1-way if you add this additional round or some other feature?
[If not, we're in danger of throwing in complications because they look
complex to us -- not because we know they do any good.]

What would be the units of such a function? ...bits of Entropy? (probably not)
My favorite units would be: power [as in m of O(k^m)] of the minimum
(space&time) algorithm in P which could find collisions.  However, I'm told
that no one is capable of finding m from an algorithm description.  [I'm
embarrassingly weak in complexity theory.]
From: martin@minster.york.ac.uk
Newsgroups: sci.crypt
Subject: GCHQ's location. No big secret!
Date: 29 Aug 92 12:50:56 GMT
Organization: Department of Computer Science, University of York, England

segr@nessie.mcc.ac.uk (Simon Read) says:
> Subject: GCHQ's location.
> 
> No big secret!
> 
> GCHQ is near Cheltenham. It's an enormous group of buildings,
> shouldn't be hard to find. I think there are even signposts.

Actually it isn't all that long ago (approx 7 years?) that the UK
government refused to officially acknowledge that this `enormous group
of buildings' existed, let alone say what they were for!  A fact that,
I believe, caused great amusement to people who lived in Cheltenham and
saw it every day!!!

Martin

INTERNET: martin@minster.york.ac.uk
JANET:  martin@uk.ac.york.minster
surface:
        Dr. Martin C. Atkins
        Dept. of Computer Science
        University of York
        Heslington
        York YO1 5DD
        ENGLAND
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: User authentication (was Re: secure netnews)
Date: 25 Aug 92 20:03:35 GMT
Distribution: sci
Organization: Stratus Computer, Software Engineering

In article <1992Aug21.864.168@ALMAC> keith.willis@almac.co.uk writes:
>
>        RSA public keys certified by genetic fingerprint, that being
>        verifiable against that held by a central trusted authority?
>


I just don't see what the big deal is.  You'll never meet me.  You
can't care what I look like much less what genes I have.  If you were to
know, would that make my identification any more positive?


If I give you an RSA key, that's all you need.  I'm the only one in the world
who knows the two primes in N.  That defines *me*.  Balding head or not,
height, weight, ..., even gender is all irrelevant.

I can prove I know those primes by signing something.  You can verify that
I know the primes, without learning the primes -- therefore without becoming
able to pretend to be me.

What more do you want?
Newsgroups: sci.crypt
From: jac54@cas.org ()
Subject: Re: GCHQ's location. No big secret!
Organization: Chemical Abstracts Service, Columbus, Ohio
Date: Mon, 31 Aug 1992 10:58:53 GMT

In article <715092656.11378@minster.york.ac.uk> martin@minster.york.ac.uk writes:
>segr@nessie.mcc.ac.uk (Simon Read) says:
>> Subject: GCHQ's location.
>>
>> No big secret!
>>
>> GCHQ is near Cheltenham. It's an enormous group of buildings,
>> shouldn't be hard to find. I think there are even signposts.
>
>Actually it isn't all that long ago (approx 7 years?) that the UK
>government refused to officially acknowledge that this `enormous group
>of buildings' existed, let alone say what they were for!  A fact that,
>I believe, caused great amusement to people who lived in Cheltenham and
>saw it every day!!!

	This pales in comparison to that legendary statement in
	the "Spycatcher" trial when the U.K. attorney-general admitted
	that although Sir Martin Hollis hade been head of MI6 "it did
	not mean that the organization existed before he was director-
	general or that it existed after he retired from the position."
	(I paraphrase).

	While we're on the subject, is Stella Rimington really Margaret
	Thatchers' evil twin?

	Alec.
Newsgroups: sci.crypt
From: wcs@cbnewsh.cb.att.com (Bill Stewart 908-949-0705 erebus.att.com!wcs)
Subject: Re: DES source code for Aliens
Organization: Your typical phone company involved in your typical daydream
Date: Sat, 29 Aug 1992 21:49:02 GMT

In article <BtKAxs.Cyy@world.std.com> ariel@world.std.com (Robert L Ullmann) writes:
]Note that it is entirely legal for US citizens (or anyone in the US)
]to IMPORT DES code; do feel free to access the FTP sites mentioned.

Various people have pointed out that the US Government's [alleged]
justification for banning crypto software export is that it's "armaments",
and that US Law does allow the government to restrict trafficking in armaments.
Importing crypto software may not be illegal now, but it could
become illegal quite easily, and possibly even by administrative rule-making
without requiring the help of Congress.  So import it while you can!

(Of course, the way the War On Politically Incorrect Drugs is going,
privacy-protection software may soon be declared an "Assault Weapon",
but that's a rant for alt.conspiracy :-)
-- 

				Pray for peace;      Bill
#Bill Stewart 908-949-0705 wcs@anchor.ho.att.com AT&T Bell Labs 4M312 Holmdel NJ
# Any technology distinguishable from magic is not sufficiently advanced ...
From: jbs@WATSON.IBM.COM
Newsgroups: sci.crypt
Subject: RSA-129 contest
Date: 26 Aug 92 23:48:22 GMT


         Robert Silverman posted:
:The problem I have is that one must add the time you spent looking for
:good polynomials to the total run time. However, looking for good
:polynomials is non-deterministic. We do not know of a deterministic
:method which, if you spend time t, you will succeed in reducing the
:coefficients by size F(t). Thus, you cannot predict AT all how long
:a factorization will take. On the other hand, using the base M method,
:while sub-optimal, is deterministic.
:
:If you estimate sieve time is T, and you spend (say) .2T looking
:for a better polynomial, there is no guarantee of finding one, and
:you will have increased total time by 20% for no good reason. Nor do
:you have assurances that spending the extra time will reduce the sieve time
:by more than the time you spent searching.

         I don't understand what you are saying here.  Suppose we use a
brute force technique (trying a bunch of different m values) to search
for good polynomials.  We can certainly estimate what measure we will
obtain as a function of the number of m values that we try.  We can then
predict how long the total factorization will take as a function of the
number of trials.  Minimizing this function will tell us how many m
values we should test in order to minimize the expected running time
(this assumes we fix this number in advance, actually we should quit
early if we are lucky, try more if we are unlucky, this is a detail).
It is true this does not give a worst case running time, however is it
not the case that we do not have worst case guaranteed bounds for any
competitive factoring method?  Do you not choose the number of primes
in your factor base by similar reasoning?
                          James B. Shearer
Xref: sparky sci.crypt:3090 comp.security.misc:1140
From: ahaley@eoe.co.uk (Andrew Haley)
Newsgroups: sci.crypt,comp.security.misc
Subject: Re: "Sneakers" -- action/adventure movie about Cryptography
Date: 3 Sep 92 09:41:22 GMT
Organization: EO Europe Limited, Cambridge, UK
X-Newsreader: Tin 1.1 PL3

gjb@fig.citib.com (Greg Brail) writes:

[... deleted ...]

: So -- as I've come to expect from Hollywood, most of the technical
: details in the book (and I assume the movie), are either impractical,
: impossible, or nonexistent. (There are a few neat tricks shown, however.)
: But let's assume someone does figure out how to trivially factor very
: large numbers. I understand that would defeat RSA. Am I correct? 

Yes.  The decryption key is trivially obtainable from the factors of
the public modulus.

: How about DES? 

No.  DES does not use problems in number theory.

: Are other common government and commercial cryptosystems based on
: large primes? I assume that one-time pads would still be quite effective.

Certainly.  Some cryptosystems (e.g. the proposed NIST signature
standard) are based on the discrete logarithm problem, which is
generally thought to be of similar difficulty to factoring large
primes.  It is possible that any breakthrough in number theory which
broke RSA could also be used to perform discrete log.

One time pads will always be effective.

: And how about this "Russian codes are different" stuff? Any truth to this?

No idea.

: I understand one can buy source code for DES and RSA on the streets of
: Leningrad (according to Communications of the ACM).

Source code is available by anonymous FTP.  Anyone with anonymous FTP
access in Leningrad could pick it up for free.  Papers discussing
efficient algorithms are freely available worldwide.

: Someday someone will produce a computer-cracking scene in a movie that
: looks as if the people involved have logged in to a system via a modem
: at least once in their lives. I don't think "Sneakers" will be it.
: 
: 				greg
: 
: P.S. If no one agrees that the technical details in this movie are silly,
: I'd be glad to post more.

I agree, it's silly.   Please, no more!  :-)

Andrew.

P.S.  Aren't the actors in the movie a little old to be hackers?
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: GCHQ's location. No big secret!
Date: Mon, 31 Aug 92 19:26:18 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)


Then there's the famous story about the time they were building CIA
headquarters, and a local real estate developer wanted to know how
many employees would be housed there, so he could plan some residential
developments nearby. He was completely stonewalled, so he called the
Soviet Embassy and they told him. They had it just about dead on.

David
Newsgroups: sci.crypt
From: bs@gauss.mitre.org (Robert D. Silverman)
Subject: Re: Seminar on Future Directions in Cryptography - 10/15-21/89
Organization: Research Computer Facility, MITRE Corporation, Bedford, MA
Date: Wed, 26 Aug 1992 13:49:03 GMT

In article <BtKrDB.HA9@chinet.chi.il.us> schneier@chinet.chi.il.us (Bruce Schneier) writes:
>On October 15-21, 1989, there was a seminar on Future Directions in
>Cryptography as part of the Monte Verita Seminar, in Switzerland.
>
>Did anyone here attend?  Were the papers presented at the conference
>ever published as a proceedings?
>
A more recent conference was held in Oberwolfach, Germany in July 1991.

It was entitled Public-Key Cryptography: State of the Art and Future Directions.
A proceedings has been published by Springer-Verlag. It is Lecture Notes in
Computer Science vol. 578, Beth, Frisch, & Simmons (eds)

Attendees included T.Beth, A Beutelspacher, J. Davenport, Y. Desmedt, W. Diffie,A. Lenstra, H. Lenstra, P. Montgomery, A. Odlyzko, C. Schnorr, Me, and Gus
Simmons.

McCurley, Quisquater, Rivest, and Vanstone were invited, but could not attend.
--
Bob Silverman
These are my opinions and not MITRE's.
Mitre Corporation, Bedford, MA 01730
"You can lead a horse's ass to knowledge, but you can't make him think"
Xref: sparky sci.crypt:3093 comp.security.misc:1142
From: ranck@vtserf.cc.vt.edu (Wm. L. Ranck)
Newsgroups: sci.crypt,comp.security.misc
Subject: Re: "Sneakers" -- action/adventure movie about Cryptography
Date: 3 Sep 92 13:28:28 GMT
Followup-To: sci.crypt
X-Newsreader: Tin 1.1 PL5

Andrew Haley (ahaley@eoe.co.uk) wrote:
: 
: P.S.  Aren't the actors in the movie a little old to be hackers?

   I think this is a good thing.  After all, not everyone competent
to use a computer is a 16-year-old "boy genius."  That stereotype
is getting *really* worn out. 
  
   I saw a preview of "Sneakers" when I was at the movies about a week ago.
In a couple of scenes they showed groups of letters on a screen rapidly
changing (sort of like a slot machine) and resolving into words.  Now this
bothered me.  The space characters were already in place!  In other words
it was obvious from the cyphertext what the length of each word was.
Pretty poor encryption scheme that.
   But, it looked like a fun movie anyway.
--

*******************************************************************************
* Bill Ranck     DoD #496  ranck@joesbar.cc.vt.edu                            *
*******************************************************************************
Newsgroups: sci.crypt
From: frank@D012S436.sniap.mchp.sni.de ()
Subject: Re: Secure netnews
Organization: Siemens-Nixdorf AG
Date: Mon, 31 Aug 92 12:42:33 GMT

dla@raven (Don Alvarez) writes:
: In article <1992Aug27.131849.13130@sniap.mchp.sni.de> frank@D012S436.sniap.mchp.sni.de () writes:
: >
: >my site knows me well.  Your site knows you.
: >
: >Therefore your site can certify (sign) your public key.  Mine can
: >certify mine.  ALL THAT IS REQUIRED NOW IS FOR OUR SITES TO CROSS 
: >CERTIFY EACH OTHER'S KEYS.                        [emphasis added]
: 
: And _that_ is the trick.  Sure, islands of trust do exist, but unless
: that island of trust is large enough to encompass both your site and
: mine, then, then neither you nor I can trust the identity of each
: other's *site*.  All you have done is pass the certification problem up
: one level from the individual to the site.  All the same fundamental
: issues occur at the site level as occur at the individual level.

Sure, there has to a face-to-face meeting between representatives
of our sites.  I thought I said that in the original post.  Apologies
if I didn't.

Note, though, that if each of our sites has 1000 users, we have saved
a lot of face to face meetings - 999,000-1 ?

--
Frank O'Dwyer		       			Disclaimer: 
Siemens-Nixdorf AG 	                        I will deny everything
Tel.  : +49 (89) 636-40639                      Fax.  : +49 (89) 636-45860
e-mail: Frank.ODwyer@sniap.mchp.sni.de
From: nevries@accucx.cc.ruu.nl (Nico E de Vries)
Newsgroups: sci.crypt
Subject: Re: Wordperfect file-locking (faq?)
Keywords: WordPerfect, encryption
Date: 3 Sep 92 12:48:54 GMT
Organization: Academic Computer Centre Utrecht

In <adamsd.715442992@crash> adamsd@crash.cts.com (Adams Douglas) writes:


> It's my understanding that the file-locking algorithm in Wordperfect 5.1
>is easily broken. Is this something that can be fixed or guarded against 
>(without actually doing something outside the program)? 

The only way to "fix" it is using an encryption program (meaning outside,
not as a patch or so).

>Why is it so
>easily crackable? Were they just lazy, or what?

It seems to be a combination of two factors. The basic encryption scheme
is just simple, this is probably a matter of choice. The indended purpose
will have been dayly use encryption, not spy proof. The major problem
of the WP encryption seems to be a bug. Due to the way the header of
a file is encrypted one can extract the password almost directly.

The used encryption method has to do with xoring with the password and
since the header contains known data the encrypted header leads to
the password.

>And, yes, although I'm curious how one _does_ crack it, I'm more interested
>in how to fix it - if it can be.

There are 1001+ tools to crack WP files. The best fix for know is using an
external program like PGP (available garbo etc). The best fix in time will
be WP 6.0 (currently only for OS/2 2.0 planned I believe) which might
contain RSA encryption they licenced from RSA.


Nico E. de Vries
_ _
O O  USENET nevries@cc.ruu.nl  FIDO 2:281/708.1  COMPUSERVE "soon" ???? 
 o   This text reflects MY opinions, not that of my employer BITECH.      
\_/  This text is supplied 'AS IS', no waranties of any kind apply.      
     Don't waste your time on complaining about my hopeless typostyle.
From: gardner@convex.com (Steve Gardner)
Newsgroups: sci.crypt
Subject: Re: GCHQ's location. No big secret!
Date: 2 Sep 92 14:35:39 GMT
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1992Sep2.025428.3297@decuac.dec.com> mjr@hussar.dco.dec.com (Marcus J. Ranum) writes:
>	Oh, good! Read it in the paper: must be true. Do you believe
>the bit about the aliens backing Perot's candidacy that I read in the
>Enquirer, too?
	Somewhere between believing everything you read and giving
	the Washington Post the same credibility as the Enquirer
	there is a happy medium.  Mr. Ranum I think you are a few
	iterations short of hitting that happy medium. ;-)

>The sovs were too professional and too closed-mouthed to give
>out information like that, and if they knew, the fact that they knew
>would be information they wouldn't want to reveal.
	This is a plausible argument.  Sadly, many people will 
	not get this far because of the hyperbole in the first sentence.
	Honestly, the only thing worse than believing anything because you
	read it in the paper is believing nothing because you read it
	in the paper.


							smg
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: User authentication
Date: 2 Sep 92 19:11:25 GMT
Organization: Stratus Computer, Software Engineering

In article <1992Sep1.194045.1943@bcars64a.bnr.ca> schow@bqneh23.bnr.ca (Stanley T.H. Chow) writes:
>>And, as I said, once you have a public key account, I don't care what
>>pronounceable name you use.  I (the bank) will ignore it.  The only thing
>>which matters is the public key.
>
>--------------------
>
>Lost Key alert:
>
>It has come to our attention that our private key has been
>lost. Please stop using the old public key at once and use this
>new key instead "&*(413nmlfs09uln1143".
>
>CEO of IBM
>
>----------------------
> 
>Can I now transfer some money?

Not from my bank, you can't.

This is one reason "How To Share a Secret" (Adi Shamir, CACM, Nov 79, p612)
was so important.  If you really lose your key, I guess I get to keep the
money.  :-)

Actually, being a user-friendly bank, I will certainly let you define
synonyms for your public key.  All you have to do is send the request,
listing both public keys, signed twice, once by each key.  I'll let you
list as many synonyms (aliases) as you want to bother listing -- to cover
for the case when a key is lost.  Being really friendly, I won't even
charge you for my having to store these relationship messages.  I'll lump
that in with the cost of doing business.

I'll also accept commands of the form: 'the private key for
"&*(413nmlfs09uln1143" has possibly been stolen -- stop honoring it.' --
but of course, that command has to be signed in one of the alias keys, in
order to prove it's not a forgery.