HDTenEightyP/NetNews huggingface dataset:
From: strnlght@netcom.com (David Sternlight)
Subject: Re: WordPerfect and US crypto laws
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Tue, 5 Jan 1993 19:20:18 GMT


Claus Tondering posts a message containing a common misunderstanding.
U.S. crypto laws do not prohibit the export (or import) of crypto
techniques and materials. They prohibit such export or import without
a license.  The government has behaved in such a way that at present
we know that such licenses will not be issued for certain specific
techniques, such as DES and RSA.

Maybe the Word Perfect Corporation got a license for the technique
used in Word Perfectc.

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: jp@tygra.Michigan.COM (John Palmer)
Subject: Here's a challenge
Organization: CAT-TALK Conferencing System
Date: Mon, 11 Jan 1993 02:12:58 GMT

I want to check out some components of an encryption system that I'm
using and would like to see if anyone can crack this encrypted file.
Only hint is that its text of some kind. I've uuencoded it. 

Palmer

---
begin 600 text.crypt
M]:R<BHR>T]^;FHF:WXV6G)>6FIN:C9K?EI/?G)J-BY:9EIR>BY#?EI&,G(V6
MA9:0D9K?GI/8BI&6B9J-EHN>]?6OFHV<EYJ?WYR0C)K?DYK?C)J-B9K?EI/?
MG)J-BY:9EIR>BY#U]:^:C=^-EI&)EIZ-FM^;EM^*D=^>D9&0T]^6D]^,FHV)
MEH66D-^2EI.6BYZ-FO7UNYJ)FM^/C9J,FI&+GHV:WY:3WYN0DIZ1D-^,G(V6
MBXN>WXR*WXJ1WYF0F).6D-^;EM^<GHV+GM^=D).3GHN>]?6WFM^>C)2:C-_=
MJ)>:D=^<GI'?MM^/EIR4WY:+WXJ/P-WU];Z3DY[?F9:1FM^;FI/?DIJ,FO7U
MLI[?C)R*C)[3WX^:C9R7FI_?G)",FM^+GHV;EL#?L9"1WYR>CY:,G)#?CXV0
MCXV6D-'U];:1WXZ*FHR+D-^/FHV6D)N0T]^>G9V6GI*0WY*0DXN0WY.>B9"-
MD-^;GM^,B9"3F)J-FM^:G]^2D).+FM^/C9Z+EIR7FM^;EO69EI&6C9KU];R>
MCY:,G)#1W[&0D=^<GYK?D9::D8N:WYN>WYF>C9K1W[J?WY.>WXR0DY:+GM^=
<BHV0G(V>A9:>WM^^C8V6B9J;FHV<EM'?]?7U]9K1
 
end
-- 
Its most likely a     | E-MAIL: jp@michigan.com  CAT-TALK IS BACK as a FREE
forgery, so save your | SYSTEM!! 313-882-2209 300-14400 V.32/V.32BIS/TurboPEP
flames for someone    | Anon-UUCP: System: tygra, Login: nuucp, no pw
who cares  :->        | Get file "/cat/pub/filelist" for a list of files.
From: pcl@ox.ac.uk (Paul C Leyland)
Newsgroups: sci.crypt
Subject: Re: Any way to *CREATE* Vcr+ (VCR PLUS) codes??? (please read)
Date: 5 Jan 93 10:12:13 GMT
	<1iaa91INNhgr@agate.berkeley.edu> <1993Jan4.214810.19809@udel.edu>
	<bontchev.726185474@fbihh>
Organization: Oxford University Computing Services, 13 Banbury Rd Oxford OX2
	6NN
In-reply-to: bontchev@fbihh.informatik.uni-hamburg.de's message of 4 Jan 93 22:11:14 GMT

In article <bontchev.726185474@fbihh> bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

   > This ZIP archive holds three files
   > X      readme.txt
   > X      encode.c
   > X      decode.c

   Hmm... isn't there an ftp site that has them or could somebody post
   them here for those of us who do not have access to the above
   newsgroups? Thanks.

black.ox.ac.uk (129.67.1.165) /src/vcr+.shar.Z

Have fun.

Paul
--
Paul Leyland <pcl@oxford.ac.uk>          | Hanging on in quiet desperation is
Oxford University Computing Service      |     the English way.
13 Banbury Road, Oxford, OX2 6NN, UK     | The time is come, the song is over.
Tel: +44-865-273200  Fax: +44-865-273275 | Thought I'd something more to say.
Finger pcl@black.ox.ac.uk for PGP key    |
Newsgroups: sci.crypt,alt.security.ripem
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Complete ITAR Available
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 11 Jan 1993 00:34:32 GMT


Ed Hamrick offers the ITAR in machine readable form, and I look forward
to reading my copy. In the meantime, his summary conclusion that
ftp-able material is o.k. under ITAR seems weak to me because
the justification involves language like "published" and
"released". I would argue that if someone uploads software that
violates patents, etc. that act, which some might consider theft,
is not included in the notions of "published" or "released".
But that's a tentative conclusion--don't let's argue about it
until I've had a chance to read the ITAR.

My point is that perhaps the law requires one to have the right
to publish or release in order for the language quoted to apply.
This is not yet a firm conclusion on my part, but should be read
for now as an "uh, er," until I can read further. But I didn't want
Ed's "conclusion" to stand undisputed.

Putting it another way, if PGP infringes, then the author does not
have the legal right to declare it public domain, in that he doesn't
own the infringing portion. To see this clearly, suppose I upload a
copy of Microsoft Word and declare it public domain. Saying so doesn't
make it so, and Microsoft could not only prosecute me, but also anyone
with a copy.

Some have tried to argue that if they weren't the person uploading PGP
originally, they could download and use it with impunity. As one can
see from the above reduction ad absurdum, this cannot be or the only
person Microsoft could go after would be the original uploader, but
not those with copies of that upload. Worked examples include
successful piracy prosecutions in the courts.

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt,alt.security.pgp
From: pcl@ox.ac.uk (Paul C Leyland)
Newsgroups: sci.crypt
Subject: Re: Enigma, ULTRA
Date: 4 Jan 93 11:06:21 GMT
	<PHR.92Dec31132238@napa.telebit.com>
	<1992Dec31.225705.8436@qualcomm.com>
Organization: Oxford University Computing Services, 13 Banbury Rd Oxford OX2
	6NN
In-reply-to: karn@servo.qualcomm.com's message of 31 Dec 92 22:57:05 GMT

In article <1992Dec31.225705.8436@qualcomm.com> karn@servo.qualcomm.com (Phil Karn) writes:

   If you haven't seen an Enigma machine in the flesh, I recommend it.
   It really drives home the impact that the computer subsequently had on
   the entire field of cryptography.

Seconded.

   Among other places, you can find an Enigma in the British Science
   Museum in London and the Smithsonian Museum of American History in
   Washington (formerly the Museum of History and Technology).  I first
   saw the one in the British Science Museum. As I stood staring at it,
   lost in thought about how the subtle properties of that modest little
   box changed the course of human history, an English woman and her
   young son came up and also looked at it. "What's that, mommy?" "Our
   soldiers used that in the war to keep the Germans from reading our
   messages." Argh.

I saw the Science Museum model a couple of months ago.  To be fair to
the woman, there was a TypeX machine sitting right next to the Enigma.
Was the TypeX not on show when you were there?

(For the uninformed -- TypeX was the Enigma-like machine used by the
British later in the war.  So far as anyone knows, it was unbroken by
the Axis powers.

Paul
)
--
Paul Leyland <pcl@oxford.ac.uk>          | Hanging on in quiet desperation is
Oxford University Computing Service      |     the English way.
13 Banbury Road, Oxford, OX2 6NN, UK     | The time is come, the song is over.
Tel: +44-865-273200  Fax: +44-865-273275 | Thought I'd something more to say.
Finger pcl@black.ox.ac.uk for PGP key    |
From: palmer@icat.larc.nasa.gov (Michael T. Palmer)
Newsgroups: sci.crypt
Subject: Re: Here's a challenge
Date: 11 Jan 93 17:46:22 GMT
Organization: NASA Langley Research Center, Hampton, VA  USA
NNTP-Posting-Host: icat.larc.nasa.gov

palmer@icat.larc.nasa.gov (Michael T. Palmer) writes:

>jim@rand.org (Jim Gillogly) writes:

>>In article <1993Jan11.021259.10637jp@tygra.Michigan.COM> jp@tygra.Michigan.COM (John Palmer) writes:
>>>I want to check out some components of an encryption system that I'm
>>>using and would like to see if anyone can crack this encrypted file.
>>>Only hint is that its text of some kind. I've uuencoded it. 
>>>
>>>[encrypted text deleted]

>>[decrypted text deleted]
>>Hope this answers your question about the security of that particular
>>component. :)

>Hmmm, well, I guess that takes care of my previous post about this.  It
>must have simple enough to not take much effort.

Apologies to Jim Gillogly for my assumption of simplicity of the cipher.
When things happen that fast, it's easy to say that it couldn't have taken
much effort... when in fact, it may have been a brilliant insight on his
part.

Now, just what does that conversation say, anyway?  Any speakers of Italian
out there?

-- 
Michael T. Palmer, M/S 152, NASA Langley Research Center, Hampton, VA 23681
Voice: 804-864-2044,   FAX: 804-864-7793,   Email: m.t.palmer@larc.nasa.gov
RIPEM Public Key now available  --  Consider it an envelope for your e-mail
Newsgroups: sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Followup-To: dev.null
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Thu, 7 Jan 1993 18:29:58 GMT

In article <C0HKFo.u3@exnet.co.uk> s0rah@exnet.co.uk (R A Hollands) writes:
>
>In the the dear dead days beyond recall (say, a month ago) I remember
>somebody saying,"If you make it available on a bulletin board then
>you've exported it".  It could have been David Sternlight - it's his
>style.  (Unambiguously moral or arrogantly dogmatic - you choose).
>
>If s/he's right then hasn't RSA violated the relevant regs. ?

RSA has corrected their (I think) unfortunate error, though several
have pointed out to me that MIT distributes KERBEROS, which contains
DES, in just the same way.

As to "unambiguously moral or arrogantly dogmatic" I confess to
the first. Moral relativism, in my view, is the source of much
of the mischief in the world. As for the corruption of the
educational system by the relativists earlier in this century,
words fail me.

But this newsgroup is not the place for that discussion. Replies to
dev.null.

David

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: sci.crypt
From: Owen.Lewis@purplet.demon.co.uk (Owen Lewis)
Subject: Re: Limits on the Use of
Organization: FidoNet node 2:252/305 - The Purple Tentacle, Reading
Date: Thu, 7 Jan 1993 01:29:00 +0000

 -=> Quoting Stu to All <=-

 St> The security of PGP's key encryption alogorithm is, as it should be,
 St> only as strong as it's key.  While an 8 byte alphanumeric password is
 St> hardly as secure as they 1024 bit key it protects, it would keep one
 St> busy for a little while trying to break it..

 St> Assuming an 8 letter password, and say about 70 choices for each
 St> letter ....... it would take
 St> 5.765*10^8 seconds, or about 18 years - that seems awfully secure for a
 St> simple password... if I boo boo'd, let me know..

 The maths gives only part of an answer. I think the main points might be:

        a. The expected safe time against any exhaustive attack is half 
        the maximum.
        b. The single variable with the most effect on pass word/phrase safe 
        life is the number of characters used to compose the pass**** . By my 
        calculation and assuming, as you do, a 70 char selection field and
        given a powerful attack of 10,000,000 cpm, the following expected
        safe-times would apply:
                1. Emma's boyfriend uses guess what length of password? 
                Expected safe time 4 minutes.
                2. 10 char password, EST of 2.69 million years.
                3. 11 character password, EST of 209.91 million years.
               
However, such figures only hold true if password selection is truly random. 
With no electronic aid, it took me less than 30 seconds to crack the 
example 1 password. Given the vagaries of language construction and of human 
nature, 8 letter passwords can often be broken in a matter of hours/days by 
relatively cheap attack. 

I think that the length of pass phrase allowed by PGP goes at least some way 
to redress the balance. A memorised phase of not less than 90 characters, 
consisting of more than one language and containing just a few high ASCII 
characters might prove quite tough. However, its use does require a different 
level of self discipline (and keyboard skill) than plain old 'Emma'. Even 
then, I believe that the passphrase is a point of relative vulnerability for 
serious users. 



___ Blue Wave/QWK v2.11
From: Lyle_Seaman@transarc.com
Newsgroups: sci.crypt
Subject: Re: Another well-intentioned novice's question
Date: 4 Jan 93 10:15:34 GMT
Article-I.D.: transarc.cfG9faf0Bwwb4F5T9z
	<1993Jan04.170847.18420@rchland.ibm.com>
Organization: Carnegie Mellon, Pittsburgh, PA

lwloen@rchland.vnet.ibm.com (Larry Loen) writes:
> In the hypothetical example, compression moves the overall cost up
> to 2 to the 60 from the original 2 to the 54.  That ain't chicken
> feed, but it will probably not make a serious difference in overall
> security, in the end.  If one can exhaustively break DES in a day,
> having to wait 64 days will defeat some opponents, but others will be
> just as happy on the 64th day as the first. 
> 
> Note, however, that the key technology remains breaking the basic DES.  Once
> one can spring for a cost on the order of 2 to the 54th, it does not seem
> like the typical opponent will run out of money at 2 to the 60th or that they
> will not simply wait the extra time if they do.

Does it change the analysis if I substitute "month" for "day" above?
"If one can exhaustively break DES in a month, having to wait a little
over 5 years will defeat some opponents..."

I have to imagine that it would defeat nearly all the opponents, since
most of the data will be well-nigh worthless after 5 years.  Along the
same lines, even governments can't necessarily spend 64X to complete
a job which would otherwise require an expenditure of X.

In short, linear increases in complexity with sufficiently large
constant factors may provide a better security enhancement than do
exponential increases with small constant factors.

Not a flame, just a nit.

Lyle		Transarc		707 Grant Street
412 338 4474	The Gulf Tower		Pittsburgh 15219
"I don't believe it!  I believe it, though..." 	- kazar
From: ega015@comp.lancs.ac.uk (Robert Edge)
Newsgroups: sci.crypt
Subject: PGP..
Date: 12 Jan 93 16:28:52 GMT
Organization: Department of Computing at Lancaster University, UK.


	Could some one tell me where i can find PGP.
	What anonymous FTP archives hold it?
	Thanks in advance..
			Robert.
---------------------------+--------------------------------------------------
If all the world's a stage | Robert Edge. Dept. of Engineering,Lancaster.
roll on the next act.      |ega015@comp.lancs.ac.uk ega015@cent1.lancs.ac.uk
---------------------------+-------------------------------------------------
From: mvanheyn@whale.cs.indiana.edu (Marc VanHeyningen)
Newsgroups: sci.crypt
Subject: Re: RSA
Date: 6 Jan 93 18:43:41 GMT
Organization: Computer Science Dept, Indiana University
X-Quoted: 63%

Thus said sspy@west.darkside.com (mshannon):
>I have been looking for a program that uses the RSA for the actual 
>message encryption, not just for the DES or IDEA key. I found an old copy 
>of a program called Iris, produced in England by a Mr. Peter Moreton at 
>Digital Crypto. Apparently this Iris does just that, but it's hard to 
>tell from the cryptic help file. Does anyone know of this program? It 
>also has the DES and several other ciphers, but they are all in one big 
>.exe file. Thanx in advance...

If you don't mind me asking, why would using just RSA without a
symmetric encryption method be an advantage?
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted


The dead fish goes with the flow.
From: sspy@west.darkside.com (mshannon)
Newsgroups: sci.crypt
Subject: Ciphers
Date: 4 Jan 93 06:22:50 GMT
Organization: The Dark Side of the Moon +1 408 245 SPAM

Another question, gentlemen. Suppose someone, the feds or whoever, hace 
an encrypted disk that they want to crack, but they don't know what 
cipher was used. How can they find out. Are there programs that will 
analyze it and make this determination based on the way certain ciphers 
cipher?
Can anyone define pre and post whitening and differential cryptanalysis, 
please?
Someone stated that with a mass DES chip machine using brute force to 
attack the DES, that the mode doesn't matter. Why even use it then? 
Again, thanks in advance!
Newsgroups: sci.crypt
From: m_reymond@zeus.dev.macsch.com (Mike Reymond)
Subject: Cryptologia Magazine Address
Keywords: Cryptologia
Reply-To: m_reymond@macsch.com
Organization: MacNeal-Schwendler Corporation
Date: Mon, 11 Jan 93 17:55:35 GMT


Can someone please post the address, phone number, and/or
annual subscription rate for Cryptologia?  

Also, where might I find a library in the Los Angeles area 
that has a subscription?


Thanx, Mike

Mike Reymond
MacNeal-Schwendler Corp., Los Angeles, CA, USA
m_reymond@macsch.com
(213) 259-4926
Newsgroups: sci.crypt
From: markh@wimsey.bc.ca (Mark C. Henderson)
Subject: Re: RIPEM and RSAREF available by anonymous ftp !!!
Organization: Wimsey Information Services
Date: Thu, 7 Jan 1993 18:07:01 GMT

In article <C0Hw0s.LLs@wimsey.bc.ca> markh@wimsey.bc.ca (Mark C. Henderson) writes:
>In fact, I wasn't even the first person to post it.
>(Message-ID: <1ig1k1INNhe0@flash.pax.tpa.com.au> in alt.security.pgp
>and <1993Jan6.112659.16343@bernina.ethz.ch> in sci.crypt)

Correction: actually only one of the above actually preceeded my posting,
i.e. <1993Jan6.112659.16343@bernina.ethz.ch> in sci.crypt

Mark
-- 
Mark Henderson
markh@wimsey.bc.ca
RIPEM key available by key server/finger/E-mail
Newsgroups: sci.crypt
From: phr@telebit.com (Paul Rubin)
Subject: Re: My book
Organization: Telebit Corporation; Sunnyvale, CA, USA
Date: Mon, 11 Jan 1993 07:36:35 GMT

In article <LeT4wB1w165w@west.darkside.com> sspy@west.darkside.com (mshannon) writes:

   I have concluded that using RSA keys longer than 200 digits and triple 
   encrypting the DES (360 bit keyspace?) are totally unnecessary for the 
   average person and small business owner. I believe that MailSafe provides 
   more than enough security.

Maybe if you don't know that triple DES encryption gives at most
three times 56 = 168 bits of key space, you're not qualified to
recommend to people what kind of cryptography to use.

Newsgroups: sci.crypt,alt.security,alt.security.pgp
From: vanzwol@bcstec.ca.boeing.com (Ted Van Zwol)
Subject: Re: PGP 2.1 source posted to alt.sources
Organization: Boeing
Date: Fri, 8 Jan 1993 00:42:31 GMT

In article <1993Jan7.115335.1216@cs.aukuni.ac.nz> pgut1@cs.aukuni.ac.nz (Peter Gutmann) writes:
>I have posted the PGP 2.1 sources to alt.sources - see the posting itself for
>more details (I assume everyone knows what PGP 2.1 is :-).

This intrigues me.  I'm not accusing you (Peter) of anything, but consider:

How do we know the PGP sources on alt.sources (or even that on any FTP site
for that matter) are "safe".  What kind of precautions or checks exist to
prevent bogus code from cropping up.  Why couldn't some intelligence agency
get their hands on the code and weaken the encryption algorithm just enough
for them and then distribute the modified source to the rest of the world.

I haven't looked at the source or the comments myself, so I don't know if
this is already addressed.  But, it concerns me.  Who's to say the copies of
PGP available are trustworthy?  I'm terribly confused...

-tcvz

-- 
Ted C Van Zwol                           |    Genius does what it must,
uucp:      {...!}uunet!bcstec!vanzwol    |    Talent does what it can.
internet:  vanzwol@bcstec.ca.boeing.com  |                  -Emerson
                         ^^^^ new...
Newsgroups: sci.crypt,alt.security.pgp
From: willmore@iastate.edu (David Willmore)
Subject: Re: KH-11 pictures -
Organization: Iowa State University, Ames IA
Date: Tue, 12 Jan 1993 16:28:53 GMT

lrk@k5qwb.lonestar.org (Mr. Lyn R. Kennedy) writes:

>It seems it would be more feasable to take several pictures by the same 
>satellite at slightly different locations and combine them 
>electronically. I'm not sure I understand the limits of this but I've 
>been led to beleive that it works. A similar method is being used with 
>radio-telescopes, recording the information simultaneously at several 
>sites and then combining the data to get better resolution.

There are a few differences.  The wavelength of the radio waves in
question are much longer than the light waves.  Therefore, the precision
with which the image receivers must be places is more stringent for the
optical methods.  It's just not too easy.  I'm not saying that it 
can't or isn't being done.  It's just difficult to accomplish.

--David Willmore
willmore@iastate.edu
From: rick@ee.uwm.edu (Rick Miller)
Newsgroups: sci.crypt
Subject: Re: [QUESTION]:  PUBLIC-KEYS (ETC) FOR PUBLIC BBS NETWORK
Date: 12 Jan 1993 15:10:20 GMT
Organization: Just me.
NNTP-Posting-Host: 129.89.2.33
Summary: You're better off to do it yourself.

In article <12JAN199300513143@cc.utah.edu> beezer@cc.utah.edu (BEEZER) writes:
[...]
>
>I would like to advise the author of a large public access
>BBS network of adding public-key encryption to his s/w
>as a regular feature (the BBS could be configured to keep
>individual user's keys on-file by that user).
[...]

This is a bad idea, Mr. "BEEZER".  If the encryption/decryption is done
on the BBS, then you've got CLEARTEXT ON THE BBS...  You're better off
doing the encryption on your home PC, where you can controll access to
any cleartext, and transfer only ciphertext to and from the BBS.

This is especially critical with public-key cryptography.  If *you*,
and only *you* aren't the only one with access to the cleartext, then
you've just thrown away the guarantee of authenticity which public-key
ciphers are supposed to give you.  Your private messages may be read,
and your signature may be forged.

You seal your letters inside envelopes *before* you give them to the
post-man, don't you?  Then do the same with your E-mail.  Encrypt it
*before* your delivery-agent (BBS, Fido/UUCP-node, mailer, whatever)
ever has a chance to "see" it.

Rick Miller   <rick@ee.uwm.edu> | <rick@discus.mil.wi.us>   Ricxjo Muelisto
Occupation:  Husband, Father, WEPCo. WAN Mgr., Discus Sys0p, and  Linux fan

BTW:  In case you really trust your postal workers, consider that one
	spy was caught when he, after losing his codebook, sent a loosely-
	disguised message on a post-card.  Some postal clerk just happened
	to be curious at the right (wrong?) time...

	I, personally, had my post-cards read by the US government.
	While away from home, I sent post-cards to my fiance' since
	they're cheaper to send.  I 'coded' them with a simple, phonetic
	substitution cipher so that her mother couldn't get too nosey.

	For the first few weeks (sending one post-card each and every day)
	*none* got through.  Later, they started to get through to my fiance
	smudged and rumpled... one even had a coffee-mug ring on it!  

	Guessing the cause, I send a couple extra post-cards which detailed
	the phonetic substitution we were using.  Suddenly, all of my cards
	started to go through in the normal 2-day period!

	I pity the poor drudge who had to wade through all that mush.  :-)
Newsgroups: sci.crypt