HDTenEightyP/NetNews huggingface dataset:
From: luckey@rtfm.mlb.fl.us (Jon Luckey)
Subject: Re: RSA claims 33 and 37 of U.S. patent 4,405,829
Organization: We don't need no stinkin' batches!
Date: Fri, 2 Oct 1992 16:36:04 GMT

rcain@netcom.com (Robert Cain) writes:

>Further I would like to know if anyone is aware of any prior art (filing
>was Dec. 14, 1977) using a polynomial as simple as C = M^2(mod n) even that 
>would invalidate this claim.

In volume 2 of _The Art of Computer Programming_ (Semi-numerical Algorithms),
Knuth mentions a "interesting alternative to the RSA scheme" based on
C=M^2(mod x), which he calls a SQRT box.

It was developed by Micheal Rabin, and is described in [MIT Lab. for
Comp. Sc., report TR-212 (1979)].  I'd start by looking there, even
though the report is dated 1979, the concept may go back before 1977.
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: sci.crypt
Subject: Re: Secure 32-bit checksum needed
Date: 1 Oct 92 21:33:57 GMT
Organization: Stratus Computer, Software Engineering

In article <bontchev.717961294@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>I need a 32-bit cryptographically strong checksum.

This is a contradiction in terms.

If all you keep is 32 bits, then it's too easy to find a collision for any
given checksum (ie., by brute force search).  Therefore, it's not
cryptographically strong.

To make it strong, you have to make sure that the hash algorithm which
produces those 32 bits takes many years to run on today's fastest
computer to compute a single value -- but then, you probably wouldn't
want to use it.  :-)
Newsgroups: sci.crypt
From: bart@netcom.com (Harry Bartholomew)
Subject: Re: DES source for PC?
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
X-Newsreader: Tin 1.1 PL5
Date: Tue, 6 Oct 1992 10:21:30 GMT

At ftp wuarchive.wustl.edu 
   cd mirrors4/garbo.uwasa.fi 
   then in /demo there is deshel20.zip
   and  in /fileutil there is newdes12.zip
							Bart

-- 
"Partly it may be due to a phenomenon known since the very dawn of spaceflight
in connection with certain pharmaceutical drugs. They induced adverse
psychological effects, including radical changes of mood and personality.
However the fact that they were prescribed by a physician militated
against the patient's chance of deducing that they were the proximate cause
of his suffering; indeed, he would be more inclined to ask for further drugs
to counteract the first, and since the whole process was extremely profitable
for all concerned save the ultimate consumer, they would be provided.
				John Brunner in "A Maze of Stars"
From: zeke@fasttech.uucp (Bohdan Tashchuk)
Newsgroups: sci.crypt
Subject: Re: Every Spy Should Carry a Bible
Date: 1 Oct 92 19:13:26 GMT
Article-I.D.: fasttech.1992Oct1.191326.2121
Distribution: usa
Organization: Fast Technology

In <PHR.92Sep30185509@napa.telebit.com> phr@telebit.com (Paul Rubin) writes:

>   - The calculator goes on the market and becomes popular, so
>     the spy can carry one without drawing suspicion.  The special
>     key sequence is made long enough and weird enough that no one
>     will ever enter it by accident.

This is a neat idea. If the calculator breaks, the spy goes to the nearest
office supply store and buys another. I haven't read about anything like this
in the literature. It wasn't possible much more than 20 years ago, since
computers (calculators) weren't consumer items.

How do you know TI or HP or Casio haven't already done it?  :-)

Thanks for contributing some new material to this group, rather than rehashing
the current discussions about what precautions rabidly paranoid people should
take to prevent Big Brother from spoofing ALL their communication with everyone
on every possible subject in real time.
Newsgroups: sci.crypt
From: rja14@cl.cam.ac.uk (Ross Anderson)
Subject: Re: Pseudo-one-time pads
Reply-To: rja14@cl.cam.ac.uk (Ross Anderson)
Organization: U of Cambridge, England
Date: Tue, 6 Oct 1992 11:33:56 GMT

In<1992Oct5.221733.27777@netcom.com>, rlglende@netcom.com (Robert Lewis 
Glendenning) writes:

>                                                    I have made my RNGs
> pretty unpredictable by running 32 different Additive Congruential Method
> RNGs, and only selecting one bit of each for each 32-bit number. I do so
> by randomly (another RNG) selecting the particular bit from each. Of course,
> this is computationally extremely expensive.
>
> I believe that the OTP using itis pretty safe.

I don't.

If you're using a standard linear congruential generator as supplied with
the average compiler, then it will have 32 bits of internal state and we 
can assume the attacker knows the constants (the a, b such that x_{n+1} = 
ax_{n} (mod b)).

Now guess the internal state of the generator which you use as a pointer: 
this takes on average 2^{31} tries. For each guess, do the following:

  Take about 1500 bits of keystream and from it pick, for the first of the
  32 target generators, 40 bits which would have come from that
  generator (if our guess was right).

  Use the first 32 of these bits to solve for the target generator's state 
  (note x_{n+k) = ka.x_{n} (mod b)).

  Check the next 8 bits to see if they're consistent with your reconstruction. 

    If not, go to the next guess.
    If they are, go to the second target generator

     . . .

  If no contradiction is found despite reconstructing all 32 target
generators,   
  stop.

The above can be optimised a lot - with more maths, you can discard lots of
guesses at a time. 

It can get slightly messier if the generators' recurrence relations are 
unknown, but even then it's still reasonably tractable. Even with only the 
known optimisations, you'd have to put at least 80 bits of internal state 
in each of your component generators for the above analysis to become
unfeasible. Even then, I'd be nervous about someone coming up with a better
optimisation.

This is a variant of an attack on multiplexed shift register sequences which 
I thought up in 1986 and was allowed to send off for publication in 1989;

	Cryptologia vol XIV no 3 (July 1990) pp 285 - 288
	`Solving a class of stream ciphers' 
	RJ Anderson

There's a more general (but slower) attack in:

	Proc Crypto 89 (Springer LNCS 435) pp 164 - 174
	`On the Linear Consistency Test (LCT) in Cryptanalysis'
	KC Zeng, CH Yang, TRN Rao

Stream ciphers are fun - why do so few Americans do any work in the field?
Almost all the research seems to come from Europe and China!

Ross
From: gtf1000@cus.cam.ac.uk (G.T. Falk)
Newsgroups: sci.crypt
Subject: My public key
Date: 1 Oct 92 08:44:34 GMT
Organization: U of Cambridge, England

Here is my public key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.0

mQBNAirIgNoAAAEB/ibn8Nc1FzqJzI9nbx0OzCIP9qWGFbreH6RGdjx3rDwknrRm
ZO8YAVu1nRqrN+HnCyDkCPvt0le9NBFyOHRp23cABRG0KEdlb2ZmcmV5IFQuIEZh
bGsgPGd0ZjEwMDBAY3VzLmNhbS5hYy51az4=
=CL2d
-----END PGP PUBLIC KEY BLOCK-----

Geoffrey T. Falk
gtf1000@cus.cam.ac.uk
Newsgroups: sci.crypt
From: pausch@saaf.se (Paul Schlyter)
Subject: Re: triple des encryption
Organization: SAAF, Svensk Amat|rAstronomisk F|rening
Distribution: sci
Date: Fri, 02 Oct 92 09:47:54 GMT

In article <19921.4262.5798@dosgate> "alan gahtan" <alan.gahtan@canrem.com> writes:
>Could someone please explain what is meant by "triple DES" encryption. 
>Does it mean that the plaintext message is encrypted using the same 
>password 3 times or does it mean the DES is used with three different 
>passwords?

It means neither of them.  Only two DES keys are used, let's call them
A and B.  Triple DES encryption is performed like this: encrypt message
with A, decrypt with B, encrypt again with A.

If the two keys A and B are identical, then a triple DES encryption is
equivalent to a single DES encryption using either of the keys.

-- 
---
Paul Schlyter, Swedish Amateur Astronomer's Society (SAAF)
Nybrogatan 75 A, 6 tr,  S-114 40 Stockholm,  Sweden
InterNet:  pausch@saaf.se
Newsgroups: sci.crypt
From: markh@wimsey.bc.ca (Mark C. Henderson)
Subject: Re: pgp2.0 - signing text files
Organization: BC News and Mail
Date: Mon, 28 Sep 1992 19:39:37 GMT

In article <1992Sep28.162051.19586@rz.uni-karlsruhe.de> wwe@aifb.uni-karlsruhe.de (Wolfgang Weitz) writes:
>Hi,
>
>I'd like to use pgp2.0 to sign UseNet messages and mail so that
>
> (1). *everybody* can read my postings/mails (even without pgp) and 
> (2). those who do have it can also check the signature.
>
>My problem is that ``pgp -s text'' adds the signature in 'binary' form so that
>I can't send the resulting ``text.pgp'' as ordinary mail (although the original
>text is unchanged, satisfying (1) ). On the other hand: If I use ``pgp -sa text''
>the resulting ``text.asc'' is pure ASCII (satisfying (2)), but the receiver
>needs pgp to convert the base64 representation (of signature _and_ text)
>into the original text again.
>
>So:  Is there any pgp option which allows me to sign a text file with the signature
>in base64 representation and the message body unchanged? I know that I can generate 
>a signature in a separate file using ``pgp -bsa text'' and then include the resulting 
>signature ``text.asc'' in my mail, but this way the receiver must separate signature
>and message body into two files to have pgp check it. Is there a ``standard''
>way to have pgp do this directly?

Well, this would be pretty easy to do in a sh/awk/perl script, but be
aware that many mail transport agents may subtly change your mail so
that the signature will not be valid (for instance they might do
interesting things with tabs/trailing spaces/blank lines...). A
reasonable alternative might be to include both signed and unsigned
versions of the message (signed version using -a option). While this
would double the length of the messages in question, at least everyone
could read them and the signatures would be reasonably reliable.

Mark
-- 
Mark Henderson
markh@wimsey.bc.ca
From: Marc.Ringuette@DAISY.LEARNING.CS.CMU.EDU
Newsgroups: sci.crypt
Subject: Re: Proposed noise-based encryption method
Date: 30 Sep 92 07:17:00 GMT
Article-I.D.: cs.BvDrJy.EHF.2
Organization: School of Computer Science, Carnegie Mellon
Originator: mnr@DAISY.LEARNING.CS.CMU.EDU

rahdert@thrombus.seas.upenn.edu (Dave Rahdert) writes,
> the decryption key is...a list of random binary digits...
> Each of the two parties owns a copy of this list...

You have reinvented the one-time pad, which is extremely well-known and is,
as you realized, unbreakable if the key is kept secret.  You are exactly
right in all of your analysis, and your suggestion of a pair of CDs-full 
of random data is also well-known and on target.

So congratulations for getting it right, and a small kick in the pants for
not looking it up in a book on cryptography (virtually any such book will 
have a discussion of one-time pads).


-- Marc Ringuette (mnr@cs.cmu.edu)
Newsgroups: sci.crypt
From: karger@osf.org (Paul A. Karger)
Subject: Re: Every Spy Should Carry a Bible
Organization: Open Software Foundation
Distribution: usa
Date: Thu, 1 Oct 1992 14:31:05 GMT

Book ciphers can and have been broken.  William Friedman broke
one in the 1930s without even knowing what book had been used!

Before proposing cipher schemes, everyone should have completed
the assigned required reading of David Kahn's, The Codebreakers.
While the book is somewhat dated (it predates the declassification
of the Ultra work in WWII), it is an excellent history of 
cryptography from ancient times up until (nearly) today.  Be
sure to read the hardcover edition.  The paperback edition
was severely abridged.  The book should be available in
any good library.


Newsgroups: sci.crypt
From: unruh@physics.ubc.ca (William Unruh)
Subject: Re: DES encryption unsecure?
Organization: University of British Columbia, Vancouver, B.C., Canada
Date: Tue, 29 Sep 1992 22:13:48 GMT

shulick@navajo.ucs.indiana.edu (Sam Hulick) writes:


>Someone said that they, provided an encrypted DES password
>(e.g. nC25oUpKKpq83), can take that encrypted password and DECRYPT IT,
>resulting in the actual user's password.  How possible is this?  Can someone
>e-mail me the documentation on how DES works, exactly?

>-- 
>Sam Hulick          | "The worst sin towards our fellow creatures is not to
>shulick@indiana.edu | hate them, but to be indifferent to them: that's the
>(NeXTmail welcome)  | essence of inhumanity."  --George Bernard Shaw

Interesting. Do you know the "Someone"?  Is this someone willing to
share the technique?

The password algorithm is not exactly DES ( Look in for example
Numerical Recipies by Press et al for a description of DES). It uses the
password as the key to encrypt the message 00000000 (doing an extra
permutation using the salt- the first two characters of the encrypted
password). So what this person is claiming is that given the encryption 
of this single known text 00000000 they can recover the key. This of
course would be a stupendous achievement, and would make all banking etc
transactions open. If this someone is a crook, they can make a mint, but
it is your duty to report them to the authorities or you are also liable
for their activity. If they are Honest, they must immediately report
this breakthrough to NSA  and to the world.
Now, of course they may simply mean that they can do a search, trying
all (likely) passwords and seeing if they come up with the encrypted
string. If they do they have guessed the answer. There is even a program
(Crack) to automate this with a large list of likely passwords ( large
but still a factor of a few billions smaller than the set of all
possible passwords--No I didn't calculate that "billions"- Corrections
welcome).). 
Bill Unruh
unruh@physics.ubc.ca
From: pfarrell@gmuvax2.gmu.edu (Pat Farrell)
Newsgroups: sci.crypt
Subject: Public Key certification at NCSC
Keywords: PGP, CA, NCSC, Public Key, verification
Date: 3 Oct 92 20:56:26 GMT
Organization: George Mason University, Fairfax, Virginia, USA

I'll be at this month's National Computer Security Conference
in Baltimore, Maryland. I expect that a number of the readers
of this feed and users of PGP will be there. 

This seems to me to be an opportunity to exchange public keys,
and maybe even get them signed. Is anyone else interested in
meeting sometime during the conference for this purpose?

This would at least be slightly more secure than trusting a
posted public key. Of course, whether you believe that it
really is me is a different story. I'm presenting a paper that
I wrote with a co-author that I've never met. So I can't know
that even he is who he claims - or that I am who I claim :-)

Please Email or reply via post. Even if we simply meet to talk
about PGP over a beer, it could be worthwhile.

Pat


Pat Farrell,      Grad Student                       pfarrell@cs.gmu.edu
Department of Computer Science, George Mason University, Fairfax, VA
PGP Public key available via finger           #include standard.disclaimer
Newsgroups: sci.crypt
From: ebrandt@jarthur.claremont.edu (Eli Brandt)
Subject: Re: More on cracking DES algorithm
Organization: Harvey Mudd College, Claremont, CA 91711
Date: Thu, 1 Oct 1992 04:04:58 GMT

In article <BvExML.Juq@usenet.ucs.indiana.edu> shulick@yankton.ucs.indiana.edu writes:
>Let's say someone retreives the DES source code, which is easy enough.  Why
>WOULDN'T they be able to take every single mathematical operation, reverse each
>one, and then have a "decrypt()"?

It's been done.  In fact, it will probably come with the DES
source.  It may even be called "decrypt()"!  Problem is, it requires
a key...

DES is entirely reversible if you have the key, but not very
reversible otherwise; it would be a rather useless system otherwise.

>Sam Hulick

   Eli   ebrandt@jarthur.claremont.edu
Newsgroups: sci.crypt
From: rommel@Informatik.TU-Muenchen.DE (Kai-Uwe Rommel)
Subject: Re: PGP 2.0 Announcement
Organization: Technische Universitaet Muenchen, Germany
Date: Mon, 28 Sep 1992 14:20:22 GMT

In article <1992Sep7.202207.12500@fwi.uva.nl> lankeste@fwi.uva.nl (Branko Lankester) writes:
>The new version has many ergonomic improvements, much better key
>management, faster and better conventional cryptography, faster
>public key cryptography, and faster and better data compression.  It
>also has been ported to SPARC Unix, Ultrix, VAX/VMS, Commodore Amiga,
>Atari ST, OS/2, and of course it still runs on MSDOS.

The OS/2 support is broken. I made some small change to pgp when 1.0 was
current and therefore the reference to OS/2 is still in the docs (the
patch was integrated into pgp at that time, I think).

However, I have PGP 2.0 now working on OS/2 2.0 (i.e. 32-bit) now and
will try to get my (little) changes integrated into pgp.

Kai Uwe Rommel

/* Kai Uwe Rommel --- rommel@informatik.tu-muenchen.de */

DOS ... is still a real mode only non-reentrant interrupt
handler, and always will be.                -Russell Williams
From: s0rah@exnet.co.uk (R A Hollands)
Newsgroups: sci.crypt
Subject: Re: PGP *2.0* available
Date: 5 Oct 92 16:43:54 GMT
Article-I.D.: exnet.BvnqH7.32C
Organization: ExNet Systems Ltd Public Access News, London, UK

In article <1992Oct4.075456.11026@cactus.org> ritter@cactus.org (Terry Ritter) writes:
>
> But I guess you mean that the cryptosystem can be less than secure
> if we only use it for small secrets.  I never know how to respond
> to this:  We have to set up a secure link *before* we use it.  Can
> we know the extent of the secrecy we will need in the future?  Can
> we afford to squander secrecy up front simply because we are lazy
> and would prefer not to validate public keys?  I wouldn't think so,
> but I'm certainly willing to listen.
>

(Just yell if "I really want to get out of this discussion" still applies)

If we expand "small secrets" so that our secrets are evaluated in terms of
the cost to us of their being compromised - big secrets, high cost - then
doesn't it make sense to spend only as much on secrecy as we think our
secret is worth?

Since "absolute" security is absolutely unattainable aren't we actually
obliged to do this (unless we're in it for amusement sake only)?

Isn't "good enough" good enough?  PGP seems good enough to me, but, then,
I've only got small secrets.  And a public key posted here is just a 
supply of envelopes.

Richard
Newsgroups: sci.crypt
From: Graham.Shaw@newcastle.ac.uk (G.D.Shaw)
Newsgroups: sci.crypt,alt.security,alt.security.pgp
Subject: Re: pgp2.0 - what is an appropriate key length?
Date: 26 Sep 92 09:43:06 GMT
Organization: University of Newcastle upon Tyne, UK NE1 7RU

In article <1992Sep25.191759.25545@nevada.edu> oliverm@nevada.edu (Moises Oliveira ) writes:
>
>I keep hearing that RSA uses the product of two big primes to produce a really
>big number that is hard to factor.  Appearently the diffuculty in factoring
>the product of two primes is what makes RSA so hard to crack.
>
>Now, assume that the actual factoring is trivial by use of some mathematical
>method.  What good does it do you?  Exactly how does having the two prime 
>factors of some really big number do to help you crack RSA?
>
>In other words, if see someones public key, how can I find what really
>big number they used? And then after I factor it, what whould I do to the
>encrypted communications to return it to plain text?
>
The really big number is the public key.

Factor this, and the resulting primes can be trivially combined together
to yield the private key.  Once you know the private key, you can decrypt
the message in the normal way.

Graham Shaw (dph3gds@tuda.ncl.ac.uk)
Department of Physics, Durham University, England.
Newsgroups: sci.crypt
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Message interception
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date:  5 Oct 92 14:29:25 GMT

dla@athena (Don Alvarez) writes:

> >1) Modify PGP so that it only generates a small number of secondary keys.
> >   Since the user is unaware of what key is used, he/she would never know.

> If you are going to allow the bad guy to modify the user's copy of PGP
> (or any other encryption routine), then of course the bad guy can win.

Now comes the paranoid question. How do we know that our copy of PGP
has not been modified in the way suggested by the original poster? I
have never seen the program and its sources authenticated by its
authors...

> Forget PGP for the moment, and assume that you just have a generic
> routine with access to the plaintext (your text editor, for example).
> If you can't trust the routine, then you can never be confident that
> the plaintext wasn't written to a file, inserted into a virus for
> floppy-based distribution, squirted out through a modem while the
> keyboard and phone were idle, or whatever.  I know your proposal

True, but I have not got my text editor from an ftp site and it is not
advertised to be able to do public key encryption, which makes it a
less tempting target for the subversion you are suggesting...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: max@underg.UUCP (Max Cray)
Newsgroups: sci.crypt,alt.security,alt.security.pgp
Subject: Re: pgp2.0 -  Any chance of the source being posted???
Date: Tue, 29 Sep 92 07:35:33 EDT
Organization: Underground Computing Foundation

etllnfr@eddie.ericsson.se (Lyndon Fletcher) writes:

> I've loved reading all these posts about the new PGP program. Unfortunately
> some of us don't have FTP access and so cann't download it.

If you have mail access you can get files through the ftpmail server.
Send a message with the word help to: ftpmail@decwrl.dec.com.

                                          -= Max =-
...!uunet!underg!max
...!cactus.org!underg!max
---------------------------------------------------------------------
 I program in C because it turns women on...
Newsgroups: sci.crypt
From: shulick@navajo.ucs.indiana.edu (Sam Hulick)
Subject: DES encryption unsecure?
Originator: shulick@navajo
Reply-To: shulick@navajo.ucs.indiana.edu
Organization: Vallen Software
Date: Tue, 29 Sep 1992 03:26:01 GMT


Someone said that they, provided an encrypted DES password
(e.g. nC25oUpKKpq83), can take that encrypted password and DECRYPT IT,
resulting in the actual user's password.  How possible is this?  Can someone
e-mail me the documentation on how DES works, exactly?

-- 
Sam Hulick          | "The worst sin towards our fellow creatures is not to
shulick@indiana.edu | hate them, but to be indifferent to them: that's the
(NeXTmail welcome)  | essence of inhumanity."  --George Bernard Shaw
Newsgroups: sci.crypt