HDTenEightyP/NetNews huggingface dataset:
From: phkahler@vela.acs.oakland.edu (KAHLER PAUL H.)
Subject: PGP 2.0 concern
Organization: Oakland University, Rochester MI.
Date: Thu, 1 Oct 1992 17:22:52 GMT

  I have been reading this group for a few days now, and I have seen a lot
of stuff about this PGP program. One very important question comes to mind:

How does PGP generate its prime numbers?

I agree that the pseudoprime tests are probably adequate for most use.
However, it is VERY BAD to just choose a large random number and check
that it is prime when using RSA. There are algorithms which can factor
numbers containing certain kinds of primes very quickly. If n=p*q and
either p-1 or q-1 contain no large factors, then n can be factored quickly.
For example, I found primes p=2*29^23+1 and q=some other big prime, and
calculated n=p*q with them. This gave me a number with something like
60 digits or so. I then used the Pollard P-1 algorithm to factor n.
This took less than 10 minutes on my old ATARI 800 !!!!
  Now I know that in practice, p-1 and q-1 will have a factors much bigger
than 29 (I was just testing the algorithm). But if they have no factors
bigger than say 1-100 million, someone with a REAL computer could still
factor n. This will not be the case most of the time, for random primes
of the size being used, but I think it may happen often enough to be
concerned about it. After all we are concerned enough to use RSA, so
we should at least be doing it right. So again: How does PGP get its
prime numbers?

  Paul H. K.
  phkahler@vela.acs.oakland.edu
From: bx017@cleveland.Freenet.Edu (Michel Aubin)
Newsgroups: sci.crypt
Subject: PGP... Availaible
Date: 4 Oct 1992 17:05:57 GMT
Organization: Case Western Reserve University, Cleveland, Ohio (USA)
NNTP-Posting-Host: hela.ins.cwru.edu


Hello

Where i Can see  a PGP... Program for Amiga computer...?


Please... answer me... 

bye
				
						Michel Aubin
-- 
Address Internet-=>Bx017@po.cwru.edu
Address Internet-=>Maubin@heartland.bradley.edu
Address Fidonet.-=>1:240:507  (My Name is Michel Aubin)  (On Bab-O-Manie)
From: bill@uhura1.uucp (Bill Wade)
Newsgroups: sci.crypt
Subject: Re: Why expire passwords? (was Re: Secure password generation)
Date: 29 Sep 92 16:38:30 GMT
Organization: Stoner Associates, Inc./DREM Incorporated, Houston Texas

In article <BuLCyD.DKG@cs.dal.ca> gauthier@ug.cs.dal.ca (Paul Gauthier) writes:
>In <7982@public.BTR.COM> grady@btr.BTR.COM (Grady Ward  grady@btr.com) writes:
>
>>For pronounceable passwords,
>> [...]
>
>Not relating specifically to this subject, but along the lines of passwords
>and security...
>
>Many system (almost all) provide a facility for the user's password to expire
>after a certain amount of time and then require a new password. What is
>the 'official' rationale concerning this practice?
>
>I assume the main brunt of the argument states that this somehow makes it
>harder for an attacker to guess a password.
>

Actually it does nothing to make it harder for an attacker to get the password.
It reduces the cost to you (value to the attacker) of a guess.
If I do get the password, it limits the amount of time I have to make an
attack.

The attacker may want to delay the attack until a time of his
choosing.  (We got the password into your air defense computer (which
strangely enough has a dial-in line) today, but we're not going to
launch the actual attack until December 7).

If someone really wants your password, then sooner or later they will tap
your line, or put a video camera in your ceiling.  It will be more expensive
for them if they have to maintain the wiretap or keep putting new batteries
in the video camera.

Finally, it may be that the system used to encrypt your password is of
'moderate' strength.  If it takes the bad guy an average of one month to
guess your password, and you change it every two weeks, then the bad guy
won't be able to log in as you most of the time.

Historically, people have placed unwarranted faith in the strength of their
cryptosystems.  Since we know this is a bad thing, we now like to place
unwarranted faith in the value of frequent key changes.
-- 
Any opinions above do not necessarily reflect the views of Stoner
Associates, Inc.
Xref: sparky sci.crypt:3478 alt.privacy:1881 alt.activism:16756
Newsgroups: sci.crypt,alt.privacy,alt.activism
Subject: Re: Radio program on wiretaps and encryption:  Wednesday at noon
From: jherndo@eis.calstate.edu (John Herndon)
Date: Sat, 26 Sep 1992 07:13:46 GMT
Distribution: ba,ca
Organization: Calif State Univ/Electronic Information Services

	How about some frequencies for these stations... if possible.
From: karn@servo.qualcomm.com (Phil Karn)
Newsgroups: sci.crypt
Subject: Re: smart-card fragility
Date: 5 Oct 92 05:53:10 GMT
Article-I.D.: qualcomm.1992Oct5.055310.10321
Organization: Qualcomm, Inc

In article <0#6nw8k.nagle@netcom.com> nagle@netcom.com (John Nagle) writes:
>     Another alternative is to package smart cards as things one puts
>on keyrings, rather than in wallets.  Such devices have been
>built, but don't sell well.

Crypto Ignition Keys (CIKs) for STU-III secure phones are like this.
They resemble a child's play key (plastic and oversized) but with
electrical contacts between each tooth. The key is actually a carrier
for a nonvolatile memory.

Phil
From: schneier@chinet.chi.il.us (Bruce Schneier)
Newsgroups: sci.crypt
Subject: Re: Secure 32-bit checksum needed
Date: 4 Oct 92 14:35:54 GMT
Organization: Chinet - Public Access UNIX

In article <bontchev.717961294@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>Hello, everybody!
>
>I need a 32-bit cryptographically strong checksum. I guess that I
>could run MDx or SHS on my message and get 32 bits from the result
>(which is 128 and 160 bits respectively). The question is - which 32
>bits should I take? Obviously, there are a few options:
>
>
>3) 32 bits from the middle.
>4) 32 bits, collected from random positions.

Take whatever bits you like.  It doesn't really matter.  (Actually, I
would suggest XORing each section of 32-bits together and takingthe result.)

Bruce
From: cbbrowne@csi.uottawa.ca (Christopher Browne)
Newsgroups: sci.crypt
Subject: Re: PEM question
Keywords: PEM RSA
Date: 3 Oct 92 22:25:06 GMT
Organization: Dept. of Computer Science, University of Ottawa

In article <BvI5xx.6Mu@gpu.utcs.utoronto.ca> mirage1@gpu.utcs.utoronto.ca (Robert Ames) writes:
>Question:
>
>Let's say Alice and Bob are engaged in a criminal conspiracy.
>They have an encryption system which uses RSA for key exchange, and DES
>for encipherment.
>
>Alice sends Bob an encrypted message, which is intercepted.  The plain
>text of the same message also becomes available, and through some
>cryptanalytic technique the secret DES key used for that encryption is
>found.
>
>The question is, to what extent does the discovery of the secret key
>used in that one exchange compromise the system being used?  Can one
>infer information about Alice's secret RSA key?

A) It shows that the system is pretty seriously compromised at the DES
level.  It doesn't matter how good the key exchange system is, if
someone can break the code WITHOUT a key.

B) Alice's secret RSA key isn't particularly compromised; the "evil
decoders" haven't found out any information that they wouldn't have
been able to figure out given (1) The DES key and (2) Alice's public key.

If they COULD, then it means that Bob could, from the information HE was
intended to receive, infer information about Alice's secret RSA key.  If
THAT is the case, then RSA is very seriously flawed for ANY encryption
purpose.  It ain't a good public key system no more...

-- 
Christopher Browne
cbbrowne@csi.uottawa.ca
University of Ottawa
Master of System Science Program
Newsgroups: sci.crypt
From: mirage1@gpu.utcs.utoronto.ca (Robert Ames)
Subject: PEM question
Keywords: PEM RSA 
Organization: UTCS Public Access
Date: Fri, 2 Oct 1992 16:32:19 GMT

Question:

Let's say Alice and Bob are engaged in a criminal conspiracy.
They have an encryption system which uses RSA for key exchange, and DES
for encipherment.

Alice sends Bob an encrypted message, which is intercepted.  The plain
text of the same message also becomes available, and through some
cryptanalytic technique the secret DES key used for that encryption is
found.

The question is, to what extent does the discovery of the secret key
used in that one exchange compromise the system being used?  Can one
infer information about Alice's secret RSA key?

-- 
Robert Ames mirage1@gpu.utcs.utoronto.ca  P.O. Box 724, Station 'A', Toronto
From: shulick@yankton.ucs.indiana.edu (Sam Hulick)
Newsgroups: sci.crypt
Subject: More on cracking DES algorithm
Date: 30 Sep 92 22:39:57 GMT
Article-I.D.: usenet.BvExML.Juq
Reply-To: shulick@yankton.ucs.indiana.edu
Organization: Vallen Software
Originator: shulick@yankton


NOTE: Yes, you may have noticed I'm posting a lot about breaking DES/UNIX
encryption.  I am not a hacker, I'm merely trying to understand the way it
works and learn exactly how secure this algorithm really is.  I gave up hacking
a long time ago. (:

Let's say someone retreives the DES source code, which is easy enough.  Why
WOULDN'T they be able to take every single mathematical operation, reverse each
one, and then have a "decrypt()"?  I know it's not that simple, but how has DES
made it so even a good mathematician can't just reverse all the operations?

-- 
Sam Hulick          | "The worst sin towards our fellow creatures is not to
shulick@indiana.edu | hate them, but to be indifferent to them: that's the
(NeXTmail welcome)  | essence of inhumanity."  --George Bernard Shaw
Newsgroups: sci.crypt
From: phred@well.sf.ca.us (Fred Heutte)
Subject: Re: Using genetic engineering for exhaustive DES key search
Keywords: exhaustive, DES, genetic engineering
Organization: Whole Earth 'Lectronic Link
Distribution: na
Date: Wed, 7 Oct 1992 03:44:04 GMT


Lou Scheffer's notion of a bacteria-based DES key search machine brought
to mind a section of E. O. Wilson's new book, "The Diversity of Life."
Here's a paragraph or two from p. 143 ff. . . .

    Jostein Goks0yr and Vigdis Torsvik went in search of silent bacterial
  species in a natural environment.  They chose to cut the Gordian knot
  of selective culturing by separating and comparing the DNA of the
  bacteria directly.  They took small quantities of soil from a Norwegian
  beech forest near their laboratory.  Using a succession of steps in
  extraction and centrifugation, they separated the bacteria from the
  soil and removed and purified the DNA of these organisms in a single
  common batch.  They employed extreme high pressure to shear the
  double-stranded DNA molecules into fragments of uniform size.  When
  heated, DNA molecules separate into their constituent single strands . . .

    When cooled to about 25 oC below the melting temperature, the DNA
  strands are easily brought together to form a double helix; they are
  "annealed," as the molecular biologists say.  The higher the concentration
  of complementary strands in a solution, the faster the annealing will
  occur.  If there are mixes of different species and strains of species,
  like those in the Norwegian soil bacteria, the concentration of single
  strands will be much lower than is the case when DNA from only one
  species is present; the annealing process willbe slowed to a corresponding
  degree . . .

  [A]cross all the forests and habitats for the entire world . . . we might
  expect to find many millions of hitherto unstudied species.  The bacteria
  await biologists as the black hole of taxonomy.  Few scientists have
  even tried to dream of how all that diversity can be assayed and used.

Wilson's reference for this is two articles by Goks0yr, et al., Applied
and Environmental Microbiology, 56:776-781 and 782-787 (1990).
From: kellmeye@ux1.cso.uiuc.edu (kellmeyer steven l)
Newsgroups: sci.crypt
Subject: Re: public key interception and translation, etc.
Date: 1 Oct 92 17:24:25 GMT
Organization: University of Illinois at Urbana

karger@osf.org (Paul A. Karger) writes:

>In article <6880@transfer.stratus.com>, cme@ellisun.sw.stratus.com (Carl Ellison) writes:
>|> 
>|> To achieve complete spoofing of the kind being discussed here, it's not a
>|> computer system for which covert channels are being prevented but a social
>|> system and the enemy has to achieve it without letting anyone know that the
>|> censor/intruder is active -- in a society in which free speech is a guaranteed
>|> right, no less.
>|> 
>|> How about taking this discussion to alt.tv.mission.impossible?


>While in many cases, it is possible to detect the fact that
>all communications are being trapped, that is not the case if
>the computer in question is being used in a dedicated applications
>environment with non-computer-literate users or worse still in an
>isolated location with no on-site operators, but only a security guard 
>at the door.

>For example, a commercial system at an oil-drilling site or a defense radar
>system at an isolated radar site could easily be vulnerable to complete 
>trapping and spoofing of communications.  Even a bank in downtown Manhattan
>could be vulnerable, if no one in the branch was familiar with the signs
>that spoofing is happening!  The common attitude is that if the computer
>says so, then it must be right.  

>This is a people problem, not a mathematical
>problem, but encryption must be used in the real world, not in an ivory
>tower.  That is why keys need to get changed and procedures are very critical.
>The British would likely not have broken Enigma during WWII, if the Germans
>had used the system in its theoretically best ways.  Most of the breaks
>came from bad procedures and lazy crypto operators.

Absolutely correct.  It should be noted that the "Enigma crack" did NOT 
crack all Enigma ciphers being used by all branches of the German military
service.  Luftwaffe codes were regularly broken because their operators
tended to be lazy and incompetent.  The Naval codes were only infrequently
broken, and there was at least one branch of the service (the SS?) whose
Enigma codes were NEVER broken during the course of the war.  See John 
Keegan's "The Second World War" for more exact information.

Steven Kellmeyer
-- 

Steve Kellmeyer 
kellmeye@ux1.cso.uiuc.edu
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: public key interception and translation, etc.
Date: 1 Oct 92 21:25:37 GMT
Organization: Stratus Computer, Software Engineering

In article <1992Oct1.142348.14622@osf.org> karger@osf.org (Paul A. Karger) writes:
>
>While in many cases, it is possible to detect the fact that
>all communications are being trapped, that is not the case if
>the computer in question is being used in a dedicated applications
>environment with non-computer-literate users or worse still in an
>isolated location with no on-site operators, but only a security guard 
>at the door.
>

I agree that it's possible to isolate a single machine and spoof it --
although even that smacks of Mission Impossible -- but that's not what was
being claimed in the postings which bothered me.  It was claimed that a
human who is trying to disseminate his own public key can be totally
isolated, even if he's aware of that possible attack so that it doesn't pay
for him to try to send out a key.  It is against that kind of nonsense that
I was arguing.
Xref: sparky sci.crypt:3561 alt.security.pgp:63 alt.privacy:1890
From: paul@kuhub.cc.ukans.edu
Newsgroups: sci.crypt,alt.security.pgp,alt.privacy
Subject: NIST scrutinizes DES for longer life?
Date: 30 Sep 92 15:27:33 CDT
Organization: University of Kansas Academic Computing Services

"Network World"'s Sept. 28th issue, p. 25,  has a headline
"NIST reviews DES under microscope"

NIST says it has three options

Reaffirm DES for another 5 years, withdraw DES as a standard (and
possibly issue another standard), or revise guidelines for DES use
(including certifying DES software implementations).

For more info see the article.
From: shulick@yankton.ucs.indiana.edu (Sam Hulick)
Newsgroups: sci.crypt
Subject: One-way encryption...HOW?
Date: 29 Sep 92 21:19:20 GMT
Article-I.D.: usenet.BvCz88.26w
Reply-To: shulick@yankton.ucs.indiana.edu
Organization: Vallen Software
Originator: shulick@yankton


Yes.. I admit, I'm new to the science of encryption, but I'm curious: How can
there exist such a thing as "one-way" encryption (e.g. DES, UNIX crypt)?  Can't
ALL algorithms have a "nemesis?"  For instance, take a very simple algorithm to
encrypt a single character.  newchar = char * 38 - 200.  After so many guesses,
that algorithm can be cracked and reversed.  What makes UNIX password
encryption so complex?  I understand a little of it, e.g. an encrypted passwd
consists of 13 chars, 2 of which are the salt, the rest is the actual password.
The salt determines how the password will be interpreted, correct?  But that
can't be true, if UNIX encryption is "one-way."  The encrypted password is
never interpreted, it's the inputted password that is ENcrypted and compared to
the real encrypted password.  Could someone briefly explain how this works, or
email me some kind of already-made documentation by UNIX?  Source code for UNIX
encryption would also be appreciated.  Thanks.

-- 
Sam Hulick          | "The worst sin towards our fellow creatures is not to
shulick@indiana.edu | hate them, but to be indifferent to them: that's the
(NeXTmail welcome)  | essence of inhumanity."  --George Bernard Shaw
Newsgroups: sci.crypt
From: phr@telebit.com (Paul Rubin)
Subject: Re: Every Spy Should Carry a Bible
Organization: Telebit Corporation; Sunnyvale, CA, USA
Distribution: usa
Date: 30 Sep 92 18:55:09

In article <66926@cup.portal.com> Christopher_C_Lapp@cup.portal.com writes:

   How about a cryptosystem that used the teachings of various
   religious figures in the Bible as its key?As a spy, I would write a
   passionate letter detailing my sins and moral turpitude to my spy
   partner, and he/she would assign a "long beep" to the aspects of my
   sins that were in accordance with the bible, and a "short beep" to
   those that weren't.  T output would be a Morse-code of biblical
   proportions! By using the bible as t key, we could have
   uncrackable, undetectable, and public key encryption.  Any
   comments?  Chris Lapp

Not really uncrackable as the Bible is publicly available.
Read "The Key to Rebecca", by Ken Follett, for a good story
revolving around spies breaking a book code.

One advantage of the Bible is that, at least until recent times, carrying
one wouldn't draw suspicion to the spy.  (Carrying a Hagelin machine
would be pretty incriminating).  As a modern day alternative, I've
often thought the No Such Agency could do the following:

   - write encryption/decryption code that runs in an embedded
     micro of the kind found in calculators.

   - go to favorite defense contractor that also makes calculators
     (e.g. TI), and say "we want you to make a new model of simple,
     consumer calculator, priced so lots of people will buy them
     (here's some $$$ to make it profitable), and by the way, when
     the user types this undocumented 20-keystroke sequence, it should
     run this code that we'll supply (from previous step).

   - The calculator goes on the market and becomes popular, so
     the spy can carry one without drawing suspicion.  The special
     key sequence is made long enough and weird enough that no one
     will ever enter it by accident.  Of course, hitting clear
     in this mode reverts it to a normal calculator, in case 
     someone walks in on the spy (see Follett's "Eye of the Needle").
Xref: sparky sci.crypt:3511 alt.security:4471 alt.security.pgp:40
From: smb@ulysses.att.com (Steven Bellovin)
Newsgroups: sci.crypt
Subject: Re: Pseudo-one-time pads
Date: 3 Oct 92 01:59:08 GMT
Organization: AT&T Bell Laboratories

The key, so to speak, to this scheme is how you generate the pseudo-random
numbers.  When I need good random numbers, I run DES in output feedback
mode.  Of course, the security of this PRNG is exactly that of DES itself.
From: ahaley@eoe.co.uk (Andrew Haley)
Newsgroups: sci.crypt,alt.security,alt.security.pgp
Subject: Re: pgp2.0 - what is an appropriate key length?
Date: 29 Sep 92 12:57:56 GMT
Organization: EO Europe Limited, Cambridge, UK
X-Newsreader: TIN [version 1.1 PL6]

Charles Hannum (mycroft@hal.gnu.ai.mit.edu) wrote:
: 
: In article <1422@eouk9.eoe.co.uk> ahaley@eoe.co.uk (Andrew Haley)
: writes:
: >
: > On the other hand, AFAIK PGP only uses a 128 bit hash to protect its
: > key certificates, so an attack on the hash function would be easier
: > than attacking the modulus.  Am I wrong about PGP in this respect?
: > Does PGP use some extra method to protect its certificates?
: 
: The signature is also encrypted with the signer's secret key.  Thus,
: you'd need to attack the modulus anyway.

Not necessarily.  If you could generate the same hash from two
different keys, you could get a certifying authority to sign one (e.g.
if you were a disgruntled employee).  You could then broadcast a
completely different key, one that only you could use, and it would be
indistinguishable from the genuine key.

Andrew.
Newsgroups: sci.crypt
From: ggr@koonda.acci.com.au (Greg Rose)
Subject: Re: PGP20 - Hacked???
Organization: Australian Computing and Communications Institute
Date: Thu, 1 Oct 1992 23:41:34 GMT

In article <92275.10211134AEJ7D@CMUVM.BITNET> <34AEJ7D@CMUVM.BITNET> writes:
>So far any version of PGP20 I have run across, by whatever transmission
>or encoding method, has contained mostly corrupted files. The only
>files not failing the CRC checks were PGP.EXE and the first of the
>documentation files.
>
>I'm suspicious - this looks like Someone is circulating a rather
>crudely hacked version of the program. Or am I being overly paranoid?

Either your hypothesis is true, or someone forgot to say 'binary' to
FTP...

--
Greg Rose                 Australian Computing and Communications Institute
ggr@acci.com.au                                              +61 3 282 2532
"If you ever do that again, I'll cut you out of my will!"
		    -- Captain Ross to Co-pilot Gann, "Fate is the Hunter"
From: gardner@convex.com (Steve Gardner)
Newsgroups: sci.crypt
Subject: Re: Every Spy Should Carry a Bible
Date: 1 Oct 92 21:50:48 GMT
Article-I.D.: news.1992Oct1.215048.25224
Distribution: usa
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <PHR.92Oct1132531@napa.telebit.com> phr@telebit.com (Paul Rubin) writes:
>>Why not just go buy an HP-48 and replace the chip with your own chip
>>that has everything you want. 
>You want to use an unmodified, non-fancy, non-techno-geek, consumer
>calculator identical to those used by millions of innocent people.
	Not necessarily.  You want one that *looks* identical to "an 
	unmodified, non-fancy, non-techno-geek, consumer [ etc. . . . ]"
	If you are a spy and someone is suspicious enough to take apart
	your TI calcuator you are in deep shit already.  


						smg
Newsgroups: sci.crypt