Talk:Cryptography/Archive 3

message: I just did a major edit here.  I still think the article needs a lot of improvement, though.  I tried to restructure it; before, it was something of a mish-mash.  The structure, and reason for it, is now:
(1) intro, (2) terminology (so that the terms we use later don't have to be defined inline, and they won't confuse people: plus it clarifies the whole code/cipher thing, which people will want to know), (3) history (so that the discussion of modern cryptography can have historical context), (4) modern cryptography, broken down into subsections, and (5) legal issues.  Now that I've added (5), I think it should be expanded more generally into a section "Cryptography and society", in which we talk about the effects cryptography has had on human society in general, beyond simply the governmental regulations issue.  Modern cryptography (4) is broken down into sections.  Right now it's
* Symmetric-key cryptography
* Public-key cryptography 
* Cryptanalysis (of both symmetric-key and public-key)
* Cryptographic primitives
* Cryptographic protocols
I think it's best to cover symmetric before public-key, so that the motivation for public-key can be explained in context.  The difference between symmetric and public-key cryptanalysis is better explained afterwards, and it is here that a discussion of the computational assumptions used in cryptography can be discussed, as well as key size issues.  Cryptographic primitives could perhaps be titled "Theory of cryptography": my main point there is that some cryptographic work is concerned with the connections between various cryptographic applications in terms of solvability (for instance, the existence of OWFs implies the existence of PRGs).  We could probably stress the precise definition thing a bit in that section.  Finally, under "cryptographic protocols," we can discuss just about everything else.  We could, perhaps, have a section on "secure computer systems", in which we note the emphasis on actual implementation and deployment, but I'm not sure that's really core cryptography.
A few things that need doing:
*Condense writing in all sections
*Incorporate history of PK crypto into history section?  This may be awkward in the current structure, though.
*Expand "legal issues" to "Cryptography and Society" and give broader treatment.
*Give an overview of cryptography standards: at least, what they are and some important examples.
Also a few notes about how I used terminology: (1) I stick with "cipher" over "cypher" as it is the more popular usage.  I feel strongly that the same form should be used consistently -- if we don't do this, it looks random.  (2) I try to use "cryptosystem" over "cipher" when referring to modern techniques: because block ciphers aren't full encryption systems, it's not right to equate the two in the modern setting.  For instance, in the sentence "DES can be used in CBC mode to provide a secure cryptosystem", it's important to use "cryptosystem" rather than "cipher," though "encryption scheme" would be okay.  For this same reason, I usually avoid using "cipher" when referring to public-key techniques, although I didn't avoid it completely.  Mangojuice 03:09, 4 March 2006 (UTC)
replies: text: I more or less agree with this work. I think it has improved the article by restoring some context (historical, largely) for the benefit of the reader's understanding. A review of the earlier content of this talk page will turn up the history of soem previous debate on this question. it is still relevant. ww 13:32, 5 March 2006 (UTC)
thread_title: Improving the article

message: I removed this page from the "todo priority 1" category, since there's no formal todo list, and it makes it sound like the article needs urgent attention.  Of course the article could use various improvements that we'd all like to get around to sometime, but its current state is fairly reasonable.  Feel free to restore the category if you think it's appropriate, but in that case we should also make an actual todo list, since the todo category is intended to attract other editors to work on the article, in which case they expect a list of tasks.  Phr 02:59, 16 April 2006 (UTC)
replies: text: I added it back.  According to the explanation I ready, priority has to do more with the visibility of the article rather than the importance of the items on the to-do list.  Since cryptography is referenced by a whole lot of articles (over 1000 pages in "What links here" for the article), it's appropriate for it to be category 1.  See :Category:To do, by priority.  Mangojuice 16:30, 17 April 2006 (UTC)
replies: text: But being in the category means we're supposed to have an actual to do list, and as far as I can tell, we don't have one.  It would be at Talk:Cryptography/To do, I believe.  See Template:To do and its talk page.  Should we start putting a list together? Phr 17:03, 17 April 2006 (UTC)
replies: text: You don't see it?  There is a list, at Talk:Cryptography/to do, and it's included near the top of the page under "tasks".  I added those to do list items after my major rewrite a month or so ago.  Mangojuice 17:08, 17 April 2006 (UTC)
replies: text: I see it now.  I guess I saw it before but didn't realize it was the to do list, since it says "pending tasks" instead of "to do".  Thanks.  Phr 18:43, 17 April 2006 (UTC)
thread_title: Todo list

message: Should we switch the article to inline ref-style footnotes?  Those are easier to update, I think. Phr 03:04, 21 April 2006 (UTC)
replies: text: => User:Cyde took care of it with an automated program.  Thanks! Phr 16:24, 21 April 2006 (UTC)
replies: text: Looks good this way.  It would be nice, though, if the references could go back in alphabetical order.  Mangojuice 17:06, 21 April 2006 (UTC)
thread_title:  Inline footnotes 

message: On 3 June 06, Scircle made an edit and in the process deleted much of hte article. Without an explanation, I'll be back and roll the article back to its prior state. Have to figure that out first, but the loss was large. If someone else has better facility with the WP machinery, please have it!
Alternatively, there may be a reason for doing so, though the edit summary is unedifying. So, an explanation, or I (or hopeuflly somenone who knows what they're about) will roll things back. ww 17:08, 3 June 2006 (UTC)
replies: text: => Sorry for that and thank you for reverting back the article. This was a mistake (first step in wikipedia) I will be very careful in my next contributions. (Scircle 20:58, 6 June 2006 (UTC)
thread_title: large block deleted. Why?

message: I just got rid of the last few  tags.  One I removed without putting in a citation; the request was for a citation for the rise in popularity of elliptic curve crypto; I'm sure it's covered in the sources we already have somewhere, and we really don't need inline citations for EVERYTHING. :)  I'm going away for a few days; when I come back, I'm going to take this article to WP:FAC and see what happens.  Mangojuicetalk 01:04, 15 June 2006 (UTC)
replies: text: Good job, Mango. I do have some diffciulty with one edit however. The US export status of this or that crypto product is still controlled by the laws whihch define it as a munition and require an export license. The difference from the prior regulatory regime is that there is now an expanded waived class of products. Used to be 40-bit keys were permissible (for symmetric algorithms), and anything larger was required a munitions export license. The limits are just larger now, but the definitions still apply. If I export an RSA or AES product to N Korea I will be charged under the munitions export control laws with an offense. ww 19:24, 23 June 2006 (UTC)
replies: text: In 1996, control of the export of cryptography was preempted lumped in with the Commerce department (after this point, it isn't really fair to say that crypto was "classified as a munition").  Until 2000, basically, "weak" crypto could be used for export while strong crypto could not, but this was rolled back as well.  But in 2000, the restrictions were eased again.  Now, basically ANY crypto product may be exported without a license, except if (1) it's going to an embargoed country, like N Korea (but this is no different from ANY other export to those countries), or (2) if the end-users are foreign governments, rather than individuals.  In the latter case, licenses can be obtained.  So you're right about exporting to N Korea, but that's because N Korea is under a US embargo, not because the crypto is strong.  You could send that product to, say, Japan without any special permission, though.  Mangojuicetalk 21:19, 23 June 2006 (UTC)
replies: text: Which bureaucracy administers a statute or regulation doesn't much change the underlying regulation, though it may, as it did in this case, result in moving the boundaries of definition without changing the underlying rubrics. It's my understanding that anyone attempting to export a crypto product beyond the currently permitted boundaries requires a license and without one is subject to prosecution. Any crypto to N Korea etc requires a license, which will be I gather routinely denied. ww 02:43, 24 June 2006 (UTC)
replies: text: That's true.  However, if you look at what the boundaries are, they're basically the same as any other product someone would want to export.  It may be illegal to export crypto to N. Korea, but it's also illegal to export blue jeans or soap there: it's an embargo that's the issue there.  Anyway, returning to the article: we could make this all a little more clear, but I think that saying "crypto is still a munition" requires more to back it up than we have; I'd want to see a source from legal experts describing it that way, deliberately, after the 1996 change.  I'm not sure whether the Munitions Act of 1954 was repealed with respect to crypto, or just overridden.  Mangojuicetalk 02:52, 24 June 2006 (UTC)
replies: text: M, Leaky memory reports here. The changes in 96 were prompted by complaints (largely from the financial industry) and were lmiited to those with approved uses. Anything more than the previous limits for other than the approved uses, was still verboten. The next relaxation (in 2000) I think, was to extend that same permission to nearly all users. I agree about the embargo to say, N Korea, except that some exports are allowed (as for instance food after a particularly poorly managed harvest there). No permits will be granted, irrationally given access elsewhere to good cryto, for crypto to N Korea. The 54 Act is still in effect (neither repealed nor overridden), and it was that I was concerned to get at. The permitted bounds have been extended, but they could be (in principle anyway) retracted again. I wanted Readers not to take away that the US has a free market in crypto. It doesn't, though this has little practical effect for the moment. ww 20:54, 3 July 2006 (UTC)
replies: text: The relaxation in 2000 was due to the govt mostly-losing Bernstein v. United States and beating a strategic retreat by relaxing most of the restrictions before the courts did it more completely.  The stuff about exporting to North Korea is sort of pointless since NK's main trading partner is China, and you can buy pirated Windows XP disks (containing 128 bit SSL) in Chinese computer shops for about 50 cents a pop.  There is nothing any government can do about it any more on the client side; the toothpaste is out of the tube.  Further attempts to control private communications will likely involve crackdowns on the internet as a whole, rather than on specific types of software.  I put something into the article about ubiquitous browsers with TLS; I also should have put in something about email clients (MS Outlook and Mozilla Thunderbird) that can speak IMAP or SMTP over TLS, and can also exchange S/MIME messages, but I should probably check on the details first. --Phr (talk) 06:47, 10 July 2006 (UTC)
thread_title:  References