Cryptography-Digest Digest #539, Volume #9 Thu, 13 May 99 10:13:05 EDT
Contents:
Re: TwoDeck solution (but it ain't pretty) (Boris Kazak)
Message for Bob Knauer from Paul Hyett (Paul Hyett)
Re: Newbie: Encrypting short strings (wtshaw)
Re: Algorithms where encryption=decryption? (Wei Dai)
Re: Thought question: why do public ciphers use only simple ops like shift and XOR?
(Terry Ritter)
Re: DES analysis paper (Jean-Jacques Quisquater)
Related keys in TwoDeck ([EMAIL PROTECTED])
Re: Scramdisk/Norton query (Joshua Falkin)
Re: True Randomness & The Law Of Large Numbers (R. Knauer)
3DES-CBC and key length ("dino")
Cryptography FAQ (01/10: Overview) ([EMAIL PROTECTED])
Cryptography FAQ (02/10: Net Etiquette) ([EMAIL PROTECTED])
----------------------------------------------------------------------------
From: Boris Kazak <[EMAIL PROTECTED]>
Subject: Re: TwoDeck solution (but it ain't pretty)
Date: Wed, 12 May 1999 22:19:50 -0400
Reply-To: [EMAIL PROTECTED]
[EMAIL PROTECTED] wrote:
>
> Although I agree, please keep the discussion civil. I (like others)
> want to keep it cool about these punk @#! losers...
>
> Tom
> ---------------
Tom, this is obviously a female, underdeveloped physically and
mentally, an obvious outcast, overconcerned sexually and besides having
a crush on you (heaven protect!).
Don't look further than your own school, you'll find her there.
Best wishes BNK
------------------------------
From: Paul Hyett <[EMAIL PROTECTED]>
Subject: Message for Bob Knauer from Paul Hyett
Date: Thu, 13 May 1999 07:12:57 +0100
Hi Bob,
Can you let me know via email whether my replies are getting to you, as
my ISP keeps sending me 'message delayed' notifications.
Regards,
--
Paul Hyett, Cheltenham, England
------------------------------
From: [EMAIL PROTECTED] (wtshaw)
Subject: Re: Newbie: Encrypting short strings
Date: Thu, 13 May 1999 00:45:51 -0600
In article <[EMAIL PROTECTED]>, [EMAIL PROTECTED]
(Matthias Bruestle) wrote:
> Mahlzeit
>
>
> Jim Felling ([EMAIL PROTECTED]) wrote:
> > A secure hash will have the properties you look for --just pad with
nulls out
>
> > Steve K wrote:
> > > I am looking for an algorithm that will be suitable for encrypting (and
> > > decrypting) short strings around 3 to 10 characters in length. I
would like
>
> He probably needs to decrypt these numbers.
>
The request was for an algorithm that easily produced highly variable
ciphertexts that would be difficult to easily change. Checking Ritter on
the first matter; I guess the classification of homophonic cipher pretty
well defines what you are asking for. I've tried to apply the term
probabilistic to this, but homophonic is older, covering what both what I
would call inductive encryption and deductive decryption. Schneier uses
probabilistic encryption and deterministic decryption, but deterministic
could refer to both encryption and decryption in a truely symmetric
algorithm as well.
Recap: Schneier: "In probabilistic encryption, the encrypting algorithms
is probabilistic rather than deterministic. In other words, a large
number of ciphertexts will decrypt to a given plaintex, and the particular
ciphertext used in any given encryption is randomly chosen."
Also,"Under this scheme, the ciphertext will always be larger than the
plaintext. You can't get around this; it's a result of the fact that many
ciphertexts decrypt to the same plaintexts [sic]."
It miht be good to indicate that some systems with few choices might not
increase the length when going from plaintext to ciphertext. But, these
are not that useful.
Now, the GVA does as required, without an IV, merely storing the input
randomness in a bread-crumb-trail form. Making a single block for each
entry would not be especially good, but several blocks with multiple
copies would make simple manipulation difficult.
Remembering the acceptable parameters, you wanted a few characters of
plaintext to perhaps 20 in ciphertext. It's time for a real example:
Assume a set of keys.
My defaults require a longer string in the sample implementation and
therefore produce a longer output string, but this is all scalable.
Inventory item 34568kmn-ert could be represented in 2^56 ways, including
{XD'/^9=Y%DS]XF+<WY%?S~ }
{#L2GS^IC#<J"VT,,GBW%:~ }
{/CB%5+0;NF=4V%*P*FCR=~ }
If you combined two of these, {XD'/^9=Y%DS]XF+<WY%?S~ /CB%5+0;NF=4V%*P*FCR=~ },
the result on decryption is: 34568kmn-ert 34568kmn-ert
2^56 is probably overkill, so picking a small number of output
possibilites would not lengthen the string as much; figure one character
less for each 8 bit decrease in ciphertext possibilities.
--
Weathermen prosphesize and insurance companies predict, while both pretend to be doing
the other to get an audience.
------------------------------
From: [EMAIL PROTECTED] (Wei Dai)
Subject: Re: Algorithms where encryption=decryption?
Date: Sat, 1 May 1999 00:07:22 -0700
In article <7galtg$a9g$[EMAIL PROTECTED]>, [EMAIL PROTECTED]
says...
> Let's consider permutations of order 2 with no fixed points
> (so n, the degree, must be even). According to my calculations,
> there are
> n! / (2^(n/2) * (n/2)!)
>
> such permutations. (If anyone can get a closed form for the
> number of self-inverters including those with fixed points,
> please do post it.)
The total number of self-inverters (with n even) is:
Sum[n!/((n-2i)!*2^i*i!), {i,0,n/2}]
which Mathematica managed to simplify to:
(-I)^n*2^(n/2)* HypergeometricU[-(n/2), 1/2, -(1/2)]
where HypergeometricU is the confluent hypergeometric function U(a,b,z),
although I have no idea what that means. Is that what you were looking
for?
------------------------------
From: [EMAIL PROTECTED] (Terry Ritter)
Subject: Re: Thought question: why do public ciphers use only simple ops like shift
and XOR?
Date: Thu, 06 May 1999 21:03:21 GMT
On Thu, 06 May 1999 01:30:33 GMT, in <7gqrbq$muu$[EMAIL PROTECTED]>, in
sci.crypt [EMAIL PROTECTED] wrote:
>[...]
>To me, a strong cipher is one for which there is no tractable
>break. If a devastating attack exists, the difficulty of finding
>it does not, in my view, have anything to do with the strength of
>the cipher.
But this "absolute strength" idea is something we cannot know. We
cannot know the value, we cannot know the distribution of such values,
we cannot know the probability of obtaining any particular value. In
fact, we cannot know that *any* cipher has any strength at all in this
absolute sense. As far as I can see, the idea is useless for
subsequent deduction.
On the other hand, there is something to the idea of a relative or
"contextual strength." That is, any cipher has the ability to confuse
an opponent of x capabilities (x being some combination of background,
time and resources), but not an opponent whose capabilities are
greater. Now we have parameters which represent the different
capabilities of organizations, and the idea that the longer a cipher
is around, the more effort which can be brought to bear on it, which
may eventually make it accessible even to an organization with lesser
capabilities.
>[...]
>I don't think hiding a weak cipher among
>a thousand strong ones buys much.
It buys the consequence that 999 messages of 1000 will not be exposed.
Obviously we would not use a cipher which is known weak, but if we
could know that we could distinguish it from the single cipher you
would prefer. The same cipher you use in the single-cipher system can
be part of our many-cipher system as well. Maybe *that* cipher is the
weak one.
---
Terry Ritter [EMAIL PROTECTED] http://www.io.com/~ritter/
Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
------------------------------
From: Jean-Jacques Quisquater <[EMAIL PROTECTED]>
Subject: Re: DES analysis paper
Date: Thu, 13 May 1999 11:23:35 +0200
Hi,
The best way today is to use the following CD from Springer-Verlag:
http://www.springer.de/cgi-bin/search_book.pl?isbn=3-540-65069-5
The full paper is there.
I was the author writing the text in TeX82: I've the source but
no way today to obtain the .dvi or .ps file ...
Jean-Jacques Quisquater,
Here is the beginning of the paper:
\Afour\notrace
\input mas
%
\firstpage
\mas 67
\tit Analytical characteristics of the DES
\aut Marc Davio$^{\,1, 3}$,
Yvo Desmedt$^{\,2, 4}$,
Marc Foss\'eprez$^{\,3}$,\cr
Ren\'e Govaerts$^{\,2}$,
Jan Hulsbosch$^{\,2}$,
Patrik Neutjens$^{\,2}$,\cr
Philippe Piret$^{\,1}$,
Jean-Jacques Quisquater$^{\,1}$,\cr
Joos Vandewalle$^{\,2}$,
Pascal Wouters$^{\,3}$
\mon October
\res Abstract. This paper explores equivalent representations
of the DES, at the structure level and at the function level.
Implications are the existence of analytical representations
for some tables, simplications of hardware and software.
Propositions for a new standard are made.
%>>> The prehistory of the AES call :-)
\oth \hangobj{\hbox to 20truemm{}}
$^1$\ Philips Research Laboratory, Avenue Van Becelaere, 2,
B-1170 Brussels, Belgium;
%>>> closed
\vskip -1truemm
\hangobj{\hbox to 20truemm{}}
$^2$\ Katholieke Universiteit Leuven, Laboratorium ESAT,
Kardinaal Mercierlaan, 94, B-3030 Heverlee, Belgium;
%>>> always very active
\vskip -1truemm
{\hangobj{\hbox to 20truemm{}}
$^3$\ Universite Catholique de Louvain, Batiment Maxwell,
Place du Levant, 3, B-1348 Louvain-la-Neuve, Belgium;}
%>>>> Where I'm working today!
\vskip -1truemm
{\hangobj{\hbox to 20truemm{}}
$^4$\ Sponsored by the Belgian IWONL.}
}
\endpage
------------------------------
From: [EMAIL PROTECTED]
Subject: Related keys in TwoDeck
Date: Thu, 13 May 1999 10:35:45 GMT
I just realized there are related keys in two deck. For example 'ABC'
and 'CBA' will encrypt the first block with the same subkeys. It won't
be detectable but probably can be exploited in a key search.
A possible suggest could be to use even key words for deck_A and odd
words for deck_B?
Any other suggestions?
Tom
--
PGP public keys. SPARE key is for daily work, WORK key is for
published work. The spare is at
'http://members.tripod.com/~tomstdenis/key_s.pgp'. Work key is at
'http://members.tripod.com/~tomstdenis/key.pgp'. Try SPARE first!
--== Sent via Deja.com http://www.deja.com/ ==--
---Share what you know. Learn what you don't.---
------------------------------
From: [EMAIL PROTECTED] (Joshua Falkin)
Subject: Re: Scramdisk/Norton query
Date: Thu, 13 May 1999 12:13:52 GMT
I Stumbled across this same problem. There's got to be a bug in the
Scram disk program....Why is there a hidden svl container on my hard
drive that I did not create???
I found it by sending the contents of what appeared to be an empty
Recycled bin to WinZip. there it was, 200mb of who knows what?
On Fri, 23 Apr 1999 23:44:45 GMT, "N" <[EMAIL PROTECTED]> wrote:
>Can anyone tell me why deleted files with an SVL extension keep appearing in
>my Norton protected recycle bin, even though no container files have been
>loaded or deleted and the Scramdisk utility program has not been running?
>
>When I remove them from the bin, they always reappear, often within minutes!
>They normally have a name such as 00000011.svl or 00007337.svl, for example,
>and range in size from 20K to 200Mb! I have tried excluding this file
>extension from Norton Protection, but to no avail. Norton cannot identify
>which program deleted them, but since the Scramdisk utility program isn't
>running presumably it must be work of the driver SD.VXD?
>
>It does seem to be a gross waste of space for spurious files as large as
>200Mb to be taking up this kind of space continually!
>
>Thanks
>N
>
>
>
>
>
>
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: Thu, 13 May 1999 12:23:32 GMT
Reply-To: [EMAIL PROTECTED]
On Wed, 12 May 1999 17:20:40 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
wrote:
>If you dispute that the test accomplishes the above, you should
>explain where it fails.
It fails when the TRNG outputs an "abnormal" sequence, which is itself
perfectly normal.
You would condemn a piece of metal because the atoms that comprise it
do not stay close to their origin when they diffuse.
Bob Knauer
"There is much to be said in favour of modern journalism. By giving us the opinions
of the uneducated, it keeps us in touch with the ignorance of the community."
-- Oscar Wilde
------------------------------
From: "dino" <[EMAIL PROTECTED]>
Subject: 3DES-CBC and key length
Date: 13 May 1999 13:01:07 GMT
Hi everyone
I need some help. I like to know what is the key equivalent length for a
triple DES-CBC with 3 (three) different 64 bit DES key.
Thank you in advance
------------------------------
From: [EMAIL PROTECTED]
Crossposted-To: talk.politics.crypto,sci.answers,news.answers,talk.answers
Subject: Cryptography FAQ (01/10: Overview)
Date: 13 May 1999 13:27:44 GMT
Reply-To: [EMAIL PROTECTED]
Archive-name: cryptography-faq/part01
Version: 1.0
Last-modified: 94/01/11
This is the first of ten parts of the sci.crypt FAQ. The parts are
mostly independent, but you should read this part before the rest. We
don't have the time to send out missing parts by mail, so don't ask.
Notes such as ``[KAH67]'' refer to the reference list in the last part.
Disclaimer: This document is the product of the Crypt Cabal, a secret
society which serves the National Secu---uh, no. Seriously, we're the
good guys, and we've done what we can to ensure the completeness and
accuracy of this document, but in a field of military and commercial
importance like cryptography you have to expect that some people and
organizations consider their interests more important than open
scientific discussion. Trust only what you can verify firsthand.
And don't sue us.
Many people have contributed to this FAQ. In alphabetical order:
Eric Bach, Steve Bellovin, Dan Bernstein, Nelson Bolyard, Carl Ellison,
Jim Gillogly, Mike Gleason, Doug Gwyn, Luke O'Connor, Tony Patti,
William Setzer. We apologize for any omissions.
If you have suggestions, comments, or criticism, please let the current
editors know by sending e-mail to [EMAIL PROTECTED] Bear in
mind that this is a work in progress; there are some questions which we
should add but haven't gotten around to yet. In making comments on
additions it is most helpful if you are as specific as possible and
ideally even provide the actual exact text.
Archives: sci.crypt has been archived since October 1991 on
ripem.msu.edu, though these archives are available only to U.S. and
Canadian users. Another site is rpub.cl.msu.edu in /pub/crypt/sci.crypt/
from Jan 1992. Please contact [EMAIL PROTECTED] if you know of
other archives.
The sections of this FAQ are available via anonymous FTP to rtfm.mit.edu
as /pub/usenet/news.answers/cryptography-faq/part[xx]. The Cryptography
FAQ is posted to the newsgroups sci.crypt, talk.politics.crypto,
sci.answers, and news.answers every 21 days.
The fields `Last-modified' and `Version' at the top of each part track
revisions.
Table of Contents
=================
1. Overview
2. Net Etiquette
2.1. What groups are around? What's a FAQ? Who am I? Why am I here?
2.2. Do political discussions belong in sci.crypt?
2.3. How do I present a new encryption scheme in sci.crypt?
3. Basic Cryptology
3.1. What is cryptology? Cryptography? Plaintext? Ciphertext? Encryption? Key?
3.2. What references can I start with to learn cryptology?
3.3. How does one go about cryptanalysis?
3.4. What is a brute-force search and what is its cryptographic relevance?
3.5. What are some properties satisfied by every strong cryptosystem?
3.6. If a cryptosystem is theoretically unbreakable, then is it
guaranteed analysis-proof in practice?
3.7. Why are many people still using cryptosystems that are
relatively easy to break?
3.8. What are the basic types of cryptanalytic `attacks'?
4. Mathematical Cryptology
4.1. In mathematical terms, what is a private-key cryptosystem?
4.2. What is an attack?
4.3. What's the advantage of formulating all this mathematically?
4.4. Why is the one-time pad secure?
4.5. What's a ciphertext-only attack?
4.6. What's a known-plaintext attack?
4.7. What's a chosen-plaintext attack?
4.8. In mathematical terms, what can you say about brute-force attacks?
4.9. What's a key-guessing attack? What's entropy?
5. Product Ciphers
5.1. What is a product cipher?
5.2. What makes a product cipher secure?
5.3. What are some group-theoretic properties of product ciphers?
5.4. What can be proven about the security of a product cipher?
5.5. How are block ciphers used to encrypt data longer than the block size?
5.6. Can symmetric block ciphers be used for message authentication?
5.7. What exactly is DES?
5.8. What is triple DES?
5.9. What is differential cryptanalysis?
5.10. How was NSA involved in the design of DES?
5.11. Is DES available in software?
5.12. Is DES available in hardware?
5.13. Can DES be used to protect classified information?
5.14. What are ECB, CBC, CFB, and OFB encryption?
6. Public-Key Cryptography
6.1. What is public-key cryptography?
6.2. How does public-key cryptography solve cryptography's Catch-22?
6.3. What is the role of the `trapdoor function' in public key schemes?
6.4. What is the role of the `session key' in public key schemes?
6.5. What's RSA?
6.6. Is RSA secure?
6.7. What's the difference between the RSA and Diffie-Hellman schemes?
6.8. What is `authentication' and the `key distribution problem'?
6.9. How fast can people factor numbers?
6.10. What about other public-key cryptosystems?
6.11. What is the `RSA Factoring Challenge?'
7. Digital Signatures
7.1. What is a one-way hash function?
7.2. What is the difference between public, private, secret, shared, etc.?
7.3. What are MD4 and MD5?
7.4. What is Snefru?
8. Technical Miscellany
8.1. How do I recover from lost passwords in WordPerfect?
8.2. How do I break a Vigenere (repeated-key) cipher?
8.3. How do I send encrypted mail under UNIX? [PGP, RIPEM, PEM, ...]
8.4. Is the UNIX crypt command secure?
8.5. How do I use compression with encryption?
8.6. Is there an unbreakable cipher?
8.7. What does ``random'' mean in cryptography?
8.8. What is the unicity point (a.k.a. unicity distance)?
8.9. What is key management and why is it important?
8.10. Can I use pseudo-random or chaotic numbers as a key stream?
8.11. What is the correct frequency list for English letters?
8.12. What is the Enigma?
8.13. How do I shuffle cards?
8.14. Can I foil S/W pirates by encrypting my CD-ROM?
8.15. Can you do automatic cryptanalysis of simple ciphers?
8.16. What is the coding system used by VCR+?
9. Other Miscellany
9.1. What is the National Security Agency (NSA)?
9.2. What are the US export regulations?
9.3. What is TEMPEST?
9.4. What are the Beale Ciphers, and are they a hoax?
9.5. What is the American Cryptogram Association, and how do I get in touch?
9.6. Is RSA patented?
9.7. What about the Voynich manuscript?
10. References
10.1. Books on history and classical methods
10.2. Books on modern methods
10.3. Survey articles
10.4. Reference articles
10.5. Journals, conference proceedings
10.6. Other
10.7. How may one obtain copies of FIPS and ANSI standards cited herein?
10.8. Electronic sources
10.9. RFCs (available from [FTPRF])
10.10. Related newsgroups
------------------------------
From: [EMAIL PROTECTED]
Crossposted-To: talk.politics.crypto,sci.answers,news.answers,talk.answers
Subject: Cryptography FAQ (02/10: Net Etiquette)
Date: 13 May 1999 13:28:01 GMT
Reply-To: [EMAIL PROTECTED]
Archive-name: cryptography-faq/part02
Last-modified: 94/06/13
This is the second of ten parts of the sci.crypt FAQ. The parts are
mostly independent, but you should read the first part before the rest.
We don't have the time to send out missing parts by mail, so don't ask.
Notes such as ``[KAH67]'' refer to the reference list in the last part.
The sections of this FAQ are available via anonymous FTP to rtfm.mit.edu
as /pub/usenet/news.answers/cryptography-faq/part[xx]. The Cryptography
FAQ is posted to the newsgroups sci.crypt, talk.politics.crypto,
sci.answers, and news.answers every 21 days.
Contents:
2.1. What groups are around? What's a FAQ? Who am I? Why am I here?
2.2. Do political discussions belong in sci.crypt?
2.3. How do I present a new encryption scheme in sci.crypt?
2.1. What groups are around? What's a FAQ? Who am I? Why am I here?
Read news.announce.newusers and news.answers for a few weeks. Always
make sure to read a newsgroup for some time before you post to it.
You'll be amazed how often the same question can be asked in the same
newsgroup. After a month you'll have a much better sense of what the
readers want to see.
2.2. Do political discussions belong in sci.crypt?
No. In fact some newsgroups (notably misc.legal.computing) were
created exactly so that political questions like ``Should RSA be
patented?'' don't get in the way of technical discussions. Many
sci.crypt readers also read misc.legal.computing, comp.org.eff.talk,
comp.patents, sci.math, comp.compression, talk.politics.crypto,
et al.; for the benefit of people who don't care about those other
topics, try to put your postings in the right group.
Questions about microfilm and smuggling and other non-cryptographic
``spy stuff'' don't belong in sci.crypt either.
2.3. How do I present a new encryption scheme in sci.crypt?
``I just came up with this neat method of encryption. Here's some
ciphertext: FHDSIJOYW^&%$*#@OGBUJHKFSYUIRE. Is it strong?'' Without a
doubt questions like this are the most annoying traffic on sci.crypt.
If you have come up with an encryption scheme, providing some
ciphertext from it is not adequate. Nobody has ever been impressed by
random gibberish. Any new algorithm should be secure even if the
opponent knows the full algorithm (including how any message key is
distributed) and only the private key is kept secret. There are some
systematic and unsystematic ways to take reasonably long ciphertexts
and decrypt them even without prior knowledge of the algorithm, but
this is a time-consuming and possibly fruitless exercise which most
sci.crypt readers won't bother with.
So what do you do if you have a new encryption scheme? First of all,
find out if it's really new. Look through this FAQ for references and
related methods. Familiarize yourself with the literature and the
introductory textbooks.
When you can appreciate how your cryptosystem fits into the world at
large, try to break it yourself! You shouldn't waste the time of tens
of thousands of readers asking a question which you could have easily
answered on your own.
If you really think your system is secure, and you want to get some
reassurance from experts, you might try posting full details of your
system, including working code and a solid theoretical explanation, to
sci.crypt. (Keep in mind that the export of cryptography is regulated
in some areas.)
If you're lucky an expert might take some interest in what you posted.
You can encourage this by offering cash rewards---for instance, noted
cryptographer Ralph Merkle is offering $1000 to anyone who can break
Snefru-4---but there are no guarantees. If you don't have enough
experience, then most likely any experts who look at your system will
be able to find a flaw. If this happens, it's your responsibility to
consider the flaw and learn from it, rather than just add one more
layer of complication and come back for another round.
A different way to get your cryptosystem reviewed is to have the NSA
look at it. A full discussion of this procedure is outside the scope
of this FAQ.
Among professionals, a common rule of thumb is that if you want to
design a cryptosystem, you have to have experience as a cryptanalyst.
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
