HDTenEightyP/NetNews huggingface dataset:
From: leonard@qiclab.scn.rain.com (Leonard Erickson)
Newsgroups: sci.crypt,comp.security.misc
Subject: Re: Crypt should be based on MD5 (was: the Crypt 16 discussion)
Date: 21 Jul 92 14:06:00 GMT
Article-I.D.: qiclab.1992Jul21.140600.23632
Reply-To: 70465.203@compuserve.com
Organization: SCN Research/Qic Laboratories of Tigard, Oregon.

ts@cup.portal.com (Tim W Smith) writes:

>> But even with this, we got squawks about "why do we need to change
>> passwords every 90 days?" (we couldn't push a shorter interval on them).
>> And we had people who insisted on being able to re-use passwords. 
>> 
>> Unless you can get the users to *care* about security, they aren't
>> going to bother.

>Has anyone shown that forcing users to change passwords every so often
>actually makes things more secure?  Isn't frequent changing of passwords
>just going to make it more likely that users will write down the passwords
>somewhere?

Well, there *are* reasons why you pretty much *have* to do periodic
changes or accept ever increasing loss of security.

We *knew* that people would give out their passwords to other users. Even
though this was very much *against* policy. by changing the passwords we
at least chopped off those "holes" every so often. Note that we were *trying*
to get users to use the "grant" command, which could be used to give 
another account specific access rights in a users files ort directories. 
It was prefffered because ypu can easily *list* who you've given what rights 
to (the TLIST command). 

We may have had some problems *due to* the changes. But we know that they
closed the holes at least temporarily. The users weren't doing a "I'll
share my password with Joe", instead it'd be something like Joe saying
"Hey, where's that report, I need it!" and the user giving Joe their 
password instead of loggining in and granting access or copying it to
a directory joe had access to.

-- 
Leonard Erickson		      leonard@qiclab.scn.rain.com
CIS: [70465,203]			 70465.203@compuserve.com
FIDO:   1:105/56	 Leonard.Erickson@f56.n105.z1.fidonet.org
(The CIS address is checked daily. The others infrequently)
Newsgroups: sci.crypt
From: schneier@chinet.chi.il.us (Bruce Schneier)
Subject: Re: Merkle/Hellman Papers
Summary: references
Date: Tue, 21 Jul 1992 21:12:39 GMT
Organization: Chinet - Public Access UNIX

References for DES meet-in-the-middle attacks:

Diffie, Whitfield and Hellman, Martin, "Exhaustive Cryptanalysis of the NBS
Data Encryption Standard," IEEE Computer, Vol 10 (1977), No. 6, Pp. 74-84.

Hoornaert, Frank, Jo Goubert and Yves Desmedt, "Efficient hardware
implementation of the DES," Advances in Cryptology: Proceedings of Crypto 84,
Springer-Verlag, 1985, Pp. 115-143.

Merkle, Ralph and Hellman, Martin, "On the Security of Multiple Encryption,"
Communicatios of the ACM, Vol 24 (1981), No. 7, Pp. 465-467.
From: ritter@cactus.org (Terry Ritter)
Subject: Re: NIST stumbles on proposal for public-key encryption
Organization: Capital Area Central Texas UNIX Society, Austin, Tx
Date: Tue, 28 Jul 1992 05:58:37 GMT


 In <25590.Jul2801.38.4492@virtualnews.nyu.edu> brnstnd@nyu.edu
 (Dan Bernstein) writes:


>One of NIST's stated goals for the standard was freedom from royalties,
>for both government and industry. Obviously ``acceptance of RSA'' is out

 If that is the case, then isn't it a shame that NIST does not own
 the public key patents.  They seem to be awfully free with rights
 they do not own.  There are at least two patent holders who claim
 that DSS infringes their patents [1].  Anyone using DSS commercially
 without licensing those patents is treading on thin ice.

 Yes, NIST is said to have received a patent on DSS, but a new
 patent is *not* a license to practice the invention.  A new patent
 is *not* a decision by the PTO that previous patents do not apply.
 Depending upon the quality of the NIST claims, the new patent may
 not even represent a bargaining position.


 [1]  Hellman, M.  1992.  Response to NIST's Proposal.  Communications
      of the ACM.  35(7):47-49.  (this is the current July issue)

 ---
 Terry Ritter   ritter@cactus.org


Newsgroups: sci.crypt
From: jonathan@chpc.utexas.edu (Jonathan Thornburg)
Subject: linear congruential RNG cipher (was: Re: Cypher algorithm question.)
Summary: this is a very bad cipher, it's easy to break
Keywords: cipher linear congruential random number xor weak Knuth break
Organization: U of Texas at Austin / Physics Dept / Center for Relativity
Date: Fri, 31 Jul 92 03:42:44 GMT

In article <tom.712397505@cluster> tom@stallion.oz.au (Thomas Essebier) writes:
>By far not being an expert on cryptology, I would appreciate some 
>comments on the crypto scheme below. 
> [ use a standard linear congruential random number generator (= RNG),
>   primed with the key, to derive a stream of bits, which is then xor-ed
>   with the data ]
>
>Where does it stand in terms of security when compared to transposition 
>cyphers, DES etc.

I'm sorry, but this is a very weak cipher -- it's very easy to break.
There are (at least) two main weaknesses:

(1)	As you described it, there are only 2^32 possible internal
	states of the RNG.  Computers are fast enough today that
	the brute-force attack of trying all of them is feasable
	for any mildly determined opponent.

(2)	The simple structure of a linear congruential RNG makes this
	scheme breakable using a much cheaper and more "elegant"
	attack.  The linear and self-inverse nature of xor
	(i.e. a xor b xor a = b) makes the RNG output stream
	recoverable from the ciphertext only with a bit of work,
	or trivially from a plaintext/ciphertext pair.  Given the
	RNG output stream, Knuth v.2 section 3.6 excercise 7
	describes how to recover the RNG parameters, including the
	starting value = crypto key.

In general, the fundamental lesson of crypto history is that good
cryptosystems are designed *only* by people who have both theoretical
knowledge of, *and* practical experience with, breaking existing
high-quality cryptosystems.  In other words, unless you have a lot
of crypto experience you're unlikely to come up with a system that
would withstand professional attack.

If you simply want a secure cryptosystem, use DES (appropriately,
i.e. in the right mode, with secure keys, and with proper attention
payed to defense against "practical cryptanalysis").  It's secure
against anyone short of a very big corporation or a medium sized
government.  And if Exxon or the FBI *really* want the contents
of your disk drive, they'll probably get it one way or the other...

- Jonathan Thornburg
  <jonathan@einstein.ph.utexas.edu> or <jonathan@hermes.chpc.utexas.edu>
  University of Texas at Austin / Physics Dept / Center for Relativity
  and (for a few more months) U of British Columbia / {Astronomy,Physics}
Newsgroups: sci.crypt
From: keith.willis@almac.co.uk
Newsgroups: sci.crypt
Subject: pretty good!
Date: 29 Jul 92 20:55:14 GMT
Distribution: sci
Organization: ALMAC PC Board




        I wonder if anybody can give me information about where I can
        obtain the new version of PGP?  I understand that it has been
        undergoing development in New Zealand (out of reach of the US
        patent laws), and was scheduled for release some time
        recently.  I have received a memo from Mr Zimmerman in which
        he states that the release was expected to take place
        'sometime in June'.

        I understand that due to both the RSA patent situation and
        the US government export restrictions, pgp cannot be obtained
        from the States, but there must be a mailserver somewhere
        that has it, if it has in fact been released.

        Replies by email, please, to avoid clogging up the ng.


---
 ~ PQ 2.15 194 ~ I've suffered for my art; now it's your turn.
--
ALMAC BBS Ltd. 0324-665371
Dos based USENET access,  call for details!
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: "random generator" passwords (was: Re: Keeping track of a lot of passwords)
Date: 27 Jul 92 15:08:53 GMT
Organization: Stratus Computer, Software Engineering

In article <1992Jul26.185623.10224@msuinfo.cl.msu.edu> mrr@scss3.cl.msu.edu (Mark Riordan) writes:
>However, a cryptographically strong function, such as 
>DES or MD5, probably would be suitable.  In fact, I wouldn't be
>surprised if crypto-based pseudo-random number generators turned
>in strong performances on most or all general-purpose PRNG tests.  

My favorite definition of a cryptographically strong PRNG holds that you
can't predict a future bit with probability better than ((1/2)+epsilon)(*),
knowing all bits which have already been output and having an arbitrary,
polynomial-size machine to do the testing.  Each general-purpose PRNG test
qualifies as such a machine.  So, if any PRNG fails any such test, then
that's grounds for declaring it cryptographically weak.

(*)[epsilon is, for example, o(2^(-k)) where k is a security parameter (eg.,
# of bits of key) under control of the user]
(Definition from Silvio Micali -- any mangling is from my faulty memory)
From: tom.rollins@p5555.f349.n109.z1.fidonet.org (tom rollins)
Newsgroups: sci.crypt
Subject: Another DES Method
Date: 22 Jul 92 15:15:25 GMT

I don't have access the this (sci.crypt) Newsgroup
so please ONLY respond to my question via E-mail
    "tom.rollins@p5555.f349.n109.z1.fidonet.org"

My Question:
    I know about the several DES encryption methods:
        ECB - Electronic Code Book
        CBC - Cipher Block Chaining
        CFB - Cipher Feed Back
        OFB - Output Feed Back
        MAC - Message Authentication Code
        KSG - Key Stream Generator

    All these methods encrypt data 64 bits at a time.
    It has been suggested that I use a 1 bit or 8 bit
    CFB (Cipher Feed Back). Now I understand how to
    feed back 1 or 4 bits, But don't understand how
    it would improve the basic method. And it would
    add a lot of processing time to the encryption /
    decryption.

                                Thanks....
                                Tom Rollins
Newsgroups: sci.crypt
From: ggm@brolga.cc.uq.oz.au (George Michaelson)
Subject: Re: Unemployed cryptologists?
Organization: Prentice Centre, University of Queensland
Date: Thu, 23 Jul 1992 03:04:23 GMT

bhall@ccwf.cc.utexas.edu (Bowman Hall) writes:

>Besides working for governments and researching at universities,
>what employment is there for cryptologists?

Startup companies making small-scale or specialist market crypto gear
such as encrypted phones, modems, cardreaders. Theres hundreds of them.

Military sales. Its a boom (sorry) market. 3CI and battlefield comms is 
	selling big isn't it?

Private Space technology 

	-error-correcting/detecting work must be close in nature and they
	have ferocious deep space needs, not to say crypto requirements
	for telemetry/guidance.

Non-illegal inter-company spying?  and counter-measures? :-)

-George
--
                         George Michaelson
G.Michaelson@cc.uq.oz.au The Prentice Centre      | There's no  market for
                         University of Queensland | hippos in Philadelphia
Phone: +61 7 365 4079    QLD Australia 4072       |          -Bertold Brecht
From: brnstnd@nyu.edu (Dan Bernstein)
Newsgroups: sci.crypt
Subject: New record non-networked factorization of difficult number
Date: 24 Jul 92 00:28:04 GMT
Organization: IR

Arjen Lenstra and I are pleased to announce the record non-networked
factorization of a difficult number (no prime factors under 40 digits).
The number is (2^488 + 1)/257. Its prime factors are p_49 and p_97,
where
  
  p_49 = 1035817877926014488587133818491976759389034764353

and

  p_97 = 3002073757428777382273857922385512797763792723266417656025\
	 021527116989779952950182556537541850817.

We carried out the bulk of the computation in under ten days on a MasPar
SIMD computer with 16384 processors at Bellcore. We also used under a
day of CPU time on a DEC workstation. The entire factorization took
approximately a month and a half real time.

This should be compared with the overall record factorization of a
difficult number, namely 2^512 + 1, which took four months real time on
approximately 700 workstations around the world, together with a
65536-processor Connection Machine in one stage.

This computation can be seen as a substantial step towards a practical
implementation of the general number field sieve (GNFS): it depended on
character columns and a square root inside the algebraic number field
rather than explicit generators of the unit group and of prime ideals of
the field. We are investigating the practical effectiveness of GNFS.

---Dan
From: bs@faron.mitre.org (Robert D. Silverman)
Newsgroups: sci.crypt
Subject: Re: New record non-networked factorization of difficult number
Date: 25 Jul 92 00:42:56 GMT
Organization: Research Computer Facility, MITRE Corporation, Bedford, MA

In article <BrwFFH.CAt@cs.psu.edu> so@fortran.cs.psu.edu (Nicol C. So) writes:

[in reply to a posting by Dan Berstein about the Number Field Sieve]

 
>Question: is the technique used here generally applicable to all
>composite numbers or is it applicable to composites of special forms?

It is applicable to all numbers,   BUT:

The reason they were able to factor a 145 digit number with the method
is because that particular number had a polynomial representation with
VERY small coefficients. The polynomial they used was x^5 + 4, i.e.
single digit coefficients. A general number of 145 digits will yield

a polynomial with coefficients around 23-24 digits --> a BIG difference.
The speed of the method strongly depends on the size of these coefficients.

My estimates show that the Number Field Sieve becomes faster than the
quadratic sieve for general integers somewhere between 135 and 140 digits.
[Although there are several optimists who think it might be slightly lower].
135 digits is currently out of reach.

Currently, NFS is better than other methods only when one can find
a polynomial representation of the number with very small coefficients.
This restricts the set of numbers that can be factored with the method
to be very small. At present this seems to be an unsurmountable obstacle
to the method. 

--
Bob Silverman
These are my opinions and not MITRE's.
Mitre Corporation, Bedford, MA 01730
"You can lead a horse's ass to knowledge, but you can't make him think"
From: hagadorn@amsaa-cleo.brl.mil (Thomas Hagadorn)
Newsgroups: sci.crypt
Subject: Re: choosing passwords (was: Re: Crypt should be based on MD5)
Date: 30 Jul 92 13:31:11 GMT
Organization: Army Materiel Systems Analysis Activity

In article <1992Jul26.202154.15664@sfu.ca> erick@fraser.sfu.ca (Erick Bryce Wong) writes:
|freitag@elrond.toppoint.de (Claus Schoenleber) writes:
|>The last digit c of an ISBN is a (weighted) checksum MOD 11:
|>
|>[a  is digit a at position i, i=10 is leftmost]
|>  i
|>
|>     [         / 10         \          ]
|>     |        /  __          \         |
|>c =  | 11 -  (   \   a  * i   ) mod 11 | mod 11
|>     |        \  /_   i      /         |
|>     [         \ i=2        /          ]
|
|You can put this in slightly simpler terms if you define i=1 to be the leftmost
|position, then the formula becomes (I think):
|
|       / #digits    \  
|      /  __          \ 
|c =  (   \   a  * i   ) mod 11
|      \  /_   i      / 
|       \ i=1        /  
|
   Almost, make that:

            / #digits    \  
           /  __          \ 
11 - c =  (   \   a  * i   ) mod 11
           \  /_   i      / 
            \ i=1        /
From: brnstnd@nyu.edu (Dan Bernstein)
Newsgroups: sci.crypt
Subject: Re: NIST stumbles on proposal for public-key encryption
Date: 28 Jul 92 01:38:44 GMT
Organization: IR

In article <1992Jul27.130448.41907@kuhub.cc.ukans.edu> paul@kuhub.cc.ukans.edu writes:
> The industry newspaper/magazine "Network World" has an excellent
> article about the NIST's Digital Signature Standard (DSS) and the
> controversy surrounding it, as opposed to international acceptance of
> RSA for both signatures and encryption.

One of NIST's stated goals for the standard was freedom from royalties,
for both government and industry. Obviously ``acceptance of RSA'' is out
of the question, given this requirement. Let me guess: Network World
quotes Bidzos as claiming that RSA is used by a majority of companies
around the world...

---Dan
Newsgroups: sci.crypt
From: erc@unislc.uucp (Ed Carp)
Subject: Where is the FAQ for sci.crypt?
X-Newsreader: Tin 1.1 PL4
Organization: Unisys Corporation SLC
Date: Thu, 30 Jul 1992 23:50:12 GMT

Is the FAQ for sci.crypt regularly posted?  I looked in news.answers, but
couldn't find it.
-- 
Ed Carp, N7EKG     erc@apple.com                801/269-8125
"This is the final task I will ever give you, and it  goes  on  forever.   Act
happy, feel happy, be happy, without a reason in the world. Then you can love,
and do what you will."           -- Dan Millman, "Way Of The Peaceful Warrior"
Newsgroups: sci.crypt
From: pbond@spitws100.sbil.co.uk (Philip Bond)
Subject: Re: can people really have trouble memorizi
Reply-To: pbond@spitws100.sbil.co.uk
Organization: Salomon Brothers, Ltd.
Date: Thu, 23 Jul 92 15:53:25 GMT

In article 24832@rchland.ibm.com, lwloen@rchland.vnet.ibm.com (Larry Loen) writes:
>This is a pretty well-studied problem and the conclusions I have learned of
>back the long password haters.  As I recall, to memorize something, it has
>to pass from short-term to long term memory.  Short term memory holds between
>3 and 7 "things" (eg 3 to 7 letters and numbers).  In some cases, I think the
>7 can go all the way to nine.
>
>BUT, the more random the things, the fewer one can remember.  Recall, too, that
>passwords often change fairly frequently (at least, when the MIS department
>controls the sign on :-) ).
>
>The telephone company, I recall, was the first to study this and it is not an
>accident that a local phone number has seven digits.  (They are now proposing
>longer phone numbers anyway, but that is a different kettle of fish -- they
>claim the world is running out of telephone numbers).
>
>Anyway, how often have you forgotten a phone number between the time Information
>gave it to you and you had to dial it?  If you are me, it is more often than
>one would care to admit in a forum this public :-)  . 
>
>
>-- 
>   Larry W. Loen        |  My Opinions are decidedly my own, so please
>                        |  do not attribute them to my employer


All true enough. Just out of curiosity, the World Record for memorising lists of
random digits is currently held by Dominic O'Brien who did 266 in 15 minutes
without error during the 1991 World Memory Championships. He is better known 
for a feat in the Guinness Book of Records ; memorising 35 mixed packs of 
cards at a single sighting. He only made 2 mistakes...
	The World Record for decimal places of PI is currently 40,000 and is
held by Hideaki Tomoyori of Japan.
	Finally, Creighton Carvello memorised the order of a single shuffled 
pack of 52 cards in around 1 minute 50 seconds in early 1992 in front 
of a live audience.
	All of these people can do a lot better in general. To get a World 
Record you have to be closely invigilated and _must not_ make even a single
error { O'Briens' card performance was so far ahead of anything done before
they let the 2 mistakes pass ... } and so they tend to go slower in order
to avoid mistakes. Tomoyori quoted the 40000 places of PI in around 17
hours without a single mistake.
	Here are guys who don't have a problem with seven character passwords...

	Usual disclaimers of course,

	Phil.

	Phil.
From: brnstnd@nyu.edu (Dan Bernstein)
Newsgroups: sci.crypt
Subject: New record non-networked factorization of difficult number
Date: 24 Jul 92 14:50:21 GMT
Organization: IR
X-Reposting-Note: article munged in first distribution; trying again

Arjen Lenstra and I are pleased to announce the record non-networked
factorization of a difficult number (no prime factors under 40 digits).
The number is (2^488 + 1)/257. Its prime factors are p_49 and p_97,
where
  
  p_49 = 1035817877926014488587133818491976759389034764353

and

  p_97 = 3002073757428777382273857922385512797763792723266417656025\
	 021527116989779952950182556537541850817.

We carried out the bulk of the computation in under ten days on a MasPar
SIMD computer with 16384 processors at Bellcore. We also used under a
day of CPU time on a DEC workstation. The entire factorization took
approximately a month and a half real time.

This should be compared with the overall record factorization of a
difficult number, namely 2^512 + 1, which took four months real time on
approximately 700 workstations around the world, together with a
65536-processor Connection Machine in one stage.

This computation can be seen as a substantial step towards a practical
implementation of the general number field sieve (GNFS): it depended on
character columns and a square root inside the algebraic number field
rather than explicit generators of the unit group and of prime ideals of
the field. We are investigating the practical effectiveness of GNFS.

---Dan
Xref: sparky sci.crypt:2752 comp.security.misc:826
From: dave@jato.jpl.nasa.gov (Dave Hayes)
Newsgroups: sci.crypt,comp.security.misc
Subject: Re: Crypt should be based on MD5 (was: the Crypt 16 discussion)
Date: 27 Jul 92 17:21:18 GMT
Reply-To: dave@jato.jpl.nasa.gov
Organization: Jet Propulsion Lab - Pasadena, CA

dhesi@cirrus.com (Rahul Dhesi) writes:

>Suppose T1 is the time it takes for the intruder to determine a password
>by some sort of search (guessing, exchaustive, whatever).  
>So what are useful values for T1 and T2?

There are other factors that put different values in T1. 

If the intruder is local and physically present...he or she may
snoop over your shoulder for the password. Assuming a login once per 
day, the average value of T1 could be on the order of a month. 

>CONCLUSION 1:  If passwords are well-chosen, password expiration adds
>nothing to security.  If passwords are poorly-chosen, password expiration
>must occur too rapidly to be of much use.

Therefore Conclusion 1 is only valid for the case where the intruder's 
only access is a passwd file. 
-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

           If you regret your gift - take it back.
Newsgroups: sci.crypt