Talk:Cryptography/Archive 4

message: I just did a major edit here.  I still think the article needs a lot of improvement, though.  I tried to restructure it; before, it was something of a mish-mash.  The structure, and reason for it, is now:
(1) intro, (2) terminology (so that the terms we use later don't have to be defined inline, and they won't confuse people: plus it clarifies the whole code/cipher thing, which people will want to know), (3) history (so that the discussion of modern cryptography can have historical context), (4) modern cryptography, broken down into subsections, and (5) legal issues.  Now that I've added (5), I think it should be expanded more generally into a section "Cryptography and society", in which we talk about the effects cryptography has had on human society in general, beyond simply the governmental regulations issue.  Modern cryptography (4) is broken down into sections.  Right now it's
* Symmetric-key cryptography
* Public-key cryptography 
* Cryptanalysis (of both symmetric-key and public-key)
* Cryptographic primitives
* Cryptographic protocols
I think it's best to cover symmetric before public-key, so that the motivation for public-key can be explained in context.  The difference between symmetric and public-key cryptanalysis is better explained afterwards, and it is here that a discussion of the computational assumptions used in cryptography can be discussed, as well as key size issues.  Cryptographic primitives could perhaps be titled "Theory of cryptography": my main point there is that some cryptographic work is concerned with the connections between various cryptographic applications in terms of solvability (for instance, the existence of OWFs implies the existence of PRGs).  We could probably stress the precise definition thing a bit in that section.  Finally, under "cryptographic protocols," we can discuss just about everything else.  We could, perhaps, have a section on "secure computer systems", in which we note the emphasis on actual implementation and deployment, but I'm not sure that's really core cryptography.
A few things that need doing:
*Condense writing in all sections
*Incorporate history of PK crypto into history section?  This may be awkward in the current structure, though.
*Expand "legal issues" to "Cryptography and Society" and give broader treatment.
*Give an overview of cryptography standards: at least, what they are and some important examples.
Also a few notes about how I used terminology: (1) I stick with "cipher" over "cypher" as it is the more popular usage.  I feel strongly that the same form should be used consistently -- if we don't do this, it looks random.  (2) I try to use "cryptosystem" over "cipher" when referring to modern techniques: because block ciphers aren't full encryption systems, it's not right to equate the two in the modern setting.  For instance, in the sentence "DES can be used in CBC mode to provide a secure cryptosystem", it's important to use "cryptosystem" rather than "cipher," though "encryption scheme" would be okay.  For this same reason, I usually avoid using "cipher" when referring to public-key techniques, although I didn't avoid it completely.  Mangojuice 03:09, 4 March 2006 (UTC)
replies: text: I more or less agree with this work. I think it has improved the article by restoring some context (historical, largely) for the benefit of the reader's understanding. A review of the earlier content of this talk page will turn up the history of soem previous debate on this question. it is still relevant. ww 13:32, 5 March 2006 (UTC)
thread_title: Improving the article

message: I removed this page from the "todo priority 1" category, since there's no formal todo list, and it makes it sound like the article needs urgent attention.  Of course the article could use various improvements that we'd all like to get around to sometime, but its current state is fairly reasonable.  Feel free to restore the category if you think it's appropriate, but in that case we should also make an actual todo list, since the todo category is intended to attract other editors to work on the article, in which case they expect a list of tasks.  Phr 02:59, 16 April 2006 (UTC)
replies: text: I added it back.  According to the explanation I ready, priority has to do more with the visibility of the article rather than the importance of the items on the to-do list.  Since cryptography is referenced by a whole lot of articles (over 1000 pages in "What links here" for the article), it's appropriate for it to be category 1.  See :Category:To do, by priority.  Mangojuice 16:30, 17 April 2006 (UTC)
replies: text: But being in the category means we're supposed to have an actual to do list, and as far as I can tell, we don't have one.  It would be at Talk:Cryptography/To do, I believe.  See Template:To do and its talk page.  Should we start putting a list together? Phr 17:03, 17 April 2006 (UTC)
replies: text: You don't see it?  There is a list, at Talk:Cryptography/to do, and it's included near the top of the page under "tasks".  I added those to do list items after my major rewrite a month or so ago.  Mangojuice 17:08, 17 April 2006 (UTC)
replies: text: I see it now.  I guess I saw it before but didn't realize it was the to do list, since it says "pending tasks" instead of "to do".  Thanks.  Phr 18:43, 17 April 2006 (UTC)
thread_title: Todo list

message: Should we switch the article to inline ref-style footnotes?  Those are easier to update, I think. Phr 03:04, 21 April 2006 (UTC)
replies: text: => User:Cyde took care of it with an automated program.  Thanks! Phr 16:24, 21 April 2006 (UTC)
replies: text: Looks good this way.  It would be nice, though, if the references could go back in alphabetical order.  Mangojuice 17:06, 21 April 2006 (UTC)
thread_title:  Inline footnotes 

message: On 3 June 06, Scircle made an edit and in the process deleted much of hte article. Without an explanation, I'll be back and roll the article back to its prior state. Have to figure that out first, but the loss was large. If someone else has better facility with the WP machinery, please have it!
Alternatively, there may be a reason for doing so, though the edit summary is unedifying. So, an explanation, or I (or hopeuflly somenone who knows what they're about) will roll things back. ww 17:08, 3 June 2006 (UTC)
replies: text: => Sorry for that and thank you for reverting back the article. This was a mistake (first step in wikipedia) I will be very careful in my next contributions. (Scircle 20:58, 6 June 2006 (UTC)
thread_title: large block deleted. Why?

message: I just got rid of the last few  tags.  One I removed without putting in a citation; the request was for a citation for the rise in popularity of elliptic curve crypto; I'm sure it's covered in the sources we already have somewhere, and we really don't need inline citations for EVERYTHING. :)  I'm going away for a few days; when I come back, I'm going to take this article to WP:FAC and see what happens.  Mangojuicetalk 01:04, 15 June 2006 (UTC)
replies: text: Good job, Mango. I do have some diffciulty with one edit however. The US export status of this or that crypto product is still controlled by the laws whihch define it as a munition and require an export license. The difference from the prior regulatory regime is that there is now an expanded waived class of products. Used to be 40-bit keys were permissible (for symmetric algorithms), and anything larger was required a munitions export license. The limits are just larger now, but the definitions still apply. If I export an RSA or AES product to N Korea I will be charged under the munitions export control laws with an offense. ww 19:24, 23 June 2006 (UTC)
replies: text: In 1996, control of the export of cryptography was preempted lumped in with the Commerce department (after this point, it isn't really fair to say that crypto was "classified as a munition").  Until 2000, basically, "weak" crypto could be used for export while strong crypto could not, but this was rolled back as well.  But in 2000, the restrictions were eased again.  Now, basically ANY crypto product may be exported without a license, except if (1) it's going to an embargoed country, like N Korea (but this is no different from ANY other export to those countries), or (2) if the end-users are foreign governments, rather than individuals.  In the latter case, licenses can be obtained.  So you're right about exporting to N Korea, but that's because N Korea is under a US embargo, not because the crypto is strong.  You could send that product to, say, Japan without any special permission, though.  Mangojuicetalk 21:19, 23 June 2006 (UTC)
replies: text: Which bureaucracy administers a statute or regulation doesn't much change the underlying regulation, though it may, as it did in this case, result in moving the boundaries of definition without changing the underlying rubrics. It's my understanding that anyone attempting to export a crypto product beyond the currently permitted boundaries requires a license and without one is subject to prosecution. Any crypto to N Korea etc requires a license, which will be I gather routinely denied. ww 02:43, 24 June 2006 (UTC)
replies: text: That's true.  However, if you look at what the boundaries are, they're basically the same as any other product someone would want to export.  It may be illegal to export crypto to N. Korea, but it's also illegal to export blue jeans or soap there: it's an embargo that's the issue there.  Anyway, returning to the article: we could make this all a little more clear, but I think that saying "crypto is still a munition" requires more to back it up than we have; I'd want to see a source from legal experts describing it that way, deliberately, after the 1996 change.  I'm not sure whether the Munitions Act of 1954 was repealed with respect to crypto, or just overridden.  Mangojuicetalk 02:52, 24 June 2006 (UTC)
replies: text: M, Leaky memory reports here. The changes in 96 were prompted by complaints (largely from the financial industry) and were lmiited to those with approved uses. Anything more than the previous limits for other than the approved uses, was still verboten. The next relaxation (in 2000) I think, was to extend that same permission to nearly all users. I agree about the embargo to say, N Korea, except that some exports are allowed (as for instance food after a particularly poorly managed harvest there). No permits will be granted, irrationally given access elsewhere to good cryto, for crypto to N Korea. The 54 Act is still in effect (neither repealed nor overridden), and it was that I was concerned to get at. The permitted bounds have been extended, but they could be (in principle anyway) retracted again. I wanted Readers not to take away that the US has a free market in crypto. It doesn't, though this has little practical effect for the moment. ww 20:54, 3 July 2006 (UTC)
replies: text: The relaxation in 2000 was due to the govt mostly-losing Bernstein v. United States and beating a strategic retreat by relaxing most of the restrictions before the courts did it more completely.  The stuff about exporting to North Korea is sort of pointless since NK's main trading partner is China, and you can buy pirated Windows XP disks (containing 128 bit SSL) in Chinese computer shops for about 50 cents a pop.  There is nothing any government can do about it any more on the client side; the toothpaste is out of the tube.  Further attempts to control private communications will likely involve crackdowns on the internet as a whole, rather than on specific types of software.  I put something into the article about ubiquitous browsers with TLS; I also should have put in something about email clients (MS Outlook and Mozilla Thunderbird) that can speak IMAP or SMTP over TLS, and can also exchange S/MIME messages, but I should probably check on the details first. --Phr (talk) 06:47, 10 July 2006 (UTC)
thread_title:  References 

message: Congrats to the editors of this article for the FA status, Great work!--ppm 19:22, 3 July 2006 (UTC)
thread_title:  Congrats 

message: Nothing against Rivest but we've credited the public-key concept to Diffie and Hellman; shouldn't we use their photos instead of Rivest's in that section? Phr (talk) 07:25, 10 July 2006 (UTC)
replies: text: Sure, and we should find contrasting photos. Wild man Diffie, and button down Hellman. Anyone have any sources? But what about Williamson and Cocks and Ellis? ww 15:33, 10 July 2006 (UTC)
replies: text: DH's contribution was first, but to be fair, Rivest is more important than either of them.  However, the picture is a bit boring; I just added it during the WP:FAC b/c of some of the comments, and because we already had the picture and it had a free license.  Mangojuicetalk 16:59, 10 July 2006 (UTC)
replies: text: There are pictures of Diffie and Hellman in their articles.  I think the Rivest picture just jarred me because it was overlarge.  I removed the size tag so it shows up at the default size now, which looks better IMO (at least with my default settings).  If I go to Crypto 2006, I can shoot some more pictures (D and H both usually attend).  I don't see how Rivest is more important; if the RSA algorithm was never discovered or didn't work, we'd be fine; DH turns into a public key algo in the obvious way, and we'd presumably still get El-Gamal signatures a while later, or at worst we could sign with Merkle hash trees. Phr (talk) 22:08, 10 July 2006 (UTC)
thread_title: Rivest photo

message: Some notes on my edits today: (1) "cryptography/cryptology" is not analagous to "biography/biology;" I know of no real analagous example, so I took that part out.  (2) removed steganography from the "in recent decades" list since that's also an ancient-times development, (3) rewrote the description of stream ciphers for accuracy, (4) removed the bit about Merkle working on PK encryption to a footnote; not that I doubt it, it's just that (a) there's no source for it and (b) this interesting trivia distracts from the flow.  (5) I introduce elliptic curve cryptography a little earlier.  (6) Removed the term "cillies" though I kept the link; the name is a little too intriguing, and disrupts the flow, but the example is still worth linking to.  Otherwise, just minor phrasing and such.  Tomorrow (7/22/06) this article will appear on the main page, so I wanted to do a check over and make sure there was nothing embarassing.  Mangojuicetalk 15:58, 21 July 2006 (UTC)
replies: text: Oh man, I didn't know about this main page appearance, I guess it's too late to get it postponed, there's really some significant changes I think we ought to do first.  (tries to shake off stage fright).  I think the biology analogy was strictly with cryptology, and didn't extend to cryptography/biography, but ok.  I'll see what quick fixes I can make today.  I wish there could have been more discussion beforehand about this main page thing.  Phr (talk) 16:13, 21 July 2006 (UTC)
replies: text: I too will try to make a last pass, though without much reference to prior posts because I'm still having 'compare' fun. I'll concentrate on small edits and won't change anything large. ww 16:19, 21 July 2006 (UTC)

text: Couple things I better ask first before doing: 1) I'd like to remove Cryptonomicon from the further reading section; it's a great novel but cryptography only slightly figures into it.  I'm a little worried about that section turning into a spam magnet.  
2) I'd like to replace the photo of Rivest in the public key section with one of Diffie and Hellman (I can make a composite image from the separate pics that are in the Diffie and Hellman biographies, so it would still be one thumbnail in the article).
  Let me know of any objections. Phr (talk) 17:09, 21 July 2006 (UTC)

text: I did the photo change.  I also rewrote the first paragraph of the public-key section, which previously overstated things somewhat.  But the new version maybe isn't strong enough.  Please take a look.  Phr (talk) 18:22, 21 July 2006 (UTC)
replies: text: Actually Cryptonomicon is shot through with crypto (or odd takes on it) and mentions quite a few historical figures. In addition to inventing some. Not sure I'd call it a geat novel... I'd keep it, as spam magnitude is not something we can control at all. If something attracts bad posts, we can have an admin lock it down for a while. ww 18:49, 21 July 2006 (UTC)
replies: text: Cryptonomicon should probably remain, as it was something that got added b/c of comments during the FAC process. :)  But I also think it's appropriate for the list; there isn't much on the lighter side there.  I like the new picture.  Mangojuicetalk 19:35, 21 July 2006 (UTC)
replies: text: I added a link to Wide Mouth Frog for a lighter tone, and if someone thinks we need more, I nominate either Kerchoff's entire name (it's a mile long) or a sentence or two in the crytpanalysis section about possible origins of the name bombe (as in Engima). ww 22:34, 21 July 2006 (UTC)
replies: text: I removed that sentence in my latest revision.  Wide Mouth Frog (which I'd never heard of; perhaps Needham-Schroeder would be a better choice?) really belongs under "cryptographic protocols", not in the primitives section.  Also, I removed the bit about primitives being used to make cryptosystems and digital signatures, because that kinda misrepresents things; those are other types of primitives, really.  Also, I remove the disclaimer about ciphers that may use the same algorithm in both directions.  Yes, that's true, but it's too detailed for that part of the article.  Mangojuicetalk 02:22, 22 July 2006 (UTC)

text: All stylistic points, I fear. We've not time enough to settle out on this stuff just now. I strongly disagree with the point about primitives, but it's a point about classification of items in categories mostly. I think not optional, but you clearly have a different classification in your mind for these things. ww 02:36, 22 July 2006 (UTC)
replies: text: Clearly, primitives can be used to build everything.  However, I don't think the study of how they build everything falls under the heading of cryptographic primitives.  Some are clearly under the heading of cryptographic protocols, for instance.  Mangojuicetalk 02:48, 22 July 2006 (UTC)
thread_title:  7/21/06 edits 

message: We will probably get a lot of new entries tomorrow. Phr (talk) 20:17, 21 July 2006 (UTC)
replies: text: The seige has begun. It will take some time to look over them all. Especially with my browser soing the long horizontal with a vengance. Arise, ye editors!! ww 05:14, 22 July 2006 (UTC)
replies: text: Try installing Wikipedia:Tools/Navigation popups, then just float your cursor over the "diff" label in the history list.  The only change so far that I take much issue with is someone more or less chopped out the 2nd paragraph about all the different kinds of math used in cryptography.  I'm so used to that paragraph (because we all worked on it a lot) that I can't tell if the shorter version is an improvement or not.  The old version was definitely long-winded, but I felt it conveyed the sweep of the subject. Phr (talk) 05:22, 22 July 2006 (UTC)
replies: text: I felt the same way, but they actually moved the paragraph to somewhere further down.  I approve of it, FWIW. Mangojuicetalk 05:40, 22 July 2006 (UTC)

text: Done; I archived all sections started in June or earlier. Mangojuicetalk 20:20, 21 July 2006 (UTC)
thread_title:  Let's archive the talk page 

message: I've expanded a stub that I found about Microsoft Cryptographic Service Providers, based on my unreliable memory of having had to mess with those things years ago.  Anyone knowledgeable about them is invited to take a look.  Phr (talk) 16:23, 14 August 2006 (UTC)
thread_title:  CSP article review request 

message: Under public-key cryptography, there's a picture of Diffie and Hellman with a subtext of "inventors of public-key cryptography", yet, elsewhere in the article there's the following text: "In 1997, it finally became publicly known that asymmetric cryptography had been invented by James H. Ellis".
Is there a minor point of contention between who really invented it or something?  It just seems a bit unclear to me.  Crimson30 18:51, 17 September 2006 (UTC)
replies: text: Yes, it should be clarified. Ellis independently developed some of the concepts. The article also fails to credit Merkle, who was really the first to submit for publication a paper describing public key crypto. Roger 19:27, 17 September 2006 (UTC)
thread_title:  Random visitor observation 

message: The caption under the public-key cryptography has an irrelevant portion.
"Padlock icon from the Firefox web browser, meant to indicate a page has been sent in SSL or TLS-encrypted protected form. But note that a properly subverted browser might mislead a user by displaying a proper icon when a transmission is not actually being protected by SSL or TLS. Security is not a straightforward issue."
The first sentence is very informative and contributes much to the cryptography article. The subsequent sentences although, do not. These other comments deserve a place possibly on the browser wiki page or the blog of a firefox fanatic. These excess comments must be removed. --166.66.103.37 02:43, 26 October 2006 (UTC)
replies: text: I agree with David, who restored it.  This kind of comment was encouraged by other editors during the Featured Article process, and it is informative and on-topic.  There is some level of consensus that this belongs in the article, and only you objecting to it, so I'm removing the tag.  Mangojuicetalk 05:54, 26 October 2006 (UTC)
thread_title:  Needless caption rambling 

message: I think this article really needs a separate section or sections on the ethical and societal implications issue of criminals using encryption. Some topics I think this article is missing:
*The use of encryption by dissidents in dictatorships to provide free speech.
*The issue of "if your not doing anything wrong then why do you need to encrypt your communications" and why a lot of feel that is misguided thinking.  
*Criminals/terrorists using encryption for nefarious purposes vs. those using it using it for free speech, privacy, or security purposes and the moral/ethical dilemma that brings up.
--Cab88 22:41, 9 December 2006 (UTC)
replies: text: It's a good idea, but given the current featured status of the article, this update should proceed cautiously.  Has much been written on the ethics of cryptography itself?  If so, we should stick to the most reputable of such writing as our source material... and if what's been written is less well-collected, we should probably just have a separate article on Ethics of cryptography, which we can link from here.  In a cursory google books search, I didn't find much written on the subject that wasn't complete bullshit, and what I did find amounted to things the US government wanted in terms of crypto (like key escrow), and that the community hasn't especially debated ethics issues.  Mangojuicetalk 17:07, 11 December 2006 (UTC)

text: There's the famous quote, "gentlemen do not read each other's mail", the phrase used by Henry L. Stimson when he closed down the US Black Chamber in 1929. As per Mangojuice, though, how we cover this topic is driven by the nature of the sources available. — Matt Crypto 17:19, 11 December 2006 (UTC)
thread_title:  Ethical and societal implications of cryprography