Cryptography-Digest Digest #260, Volume #9 Sun, 21 Mar 99 15:13:02 EST
Contents:
Re: a little math please (Chris Monico)
Re: Random Walk ("Douglas A. Gwyn")
Re: Requesting Opinions, Clarifications and Comments on Schneier's Statements (David
A Molnar)
Re: Requesting Opinions, Clarifications and Comments on Schneier's Statements (Jim
Gillogly)
On Moduli that are not quite kosher... (Ted Kaliszewski)
Re: Requesting Opinions, Clarifications and Comments on Schneier's Statements
(Darren New)
Re: pRNG that is "predictable to the left"? ("Steve Myers")
Re: Random Walk ("Douglas A. Gwyn")
Re: Random Walk (R. Knauer)
Re: Requesting Opinions, Clarifications and Comments on Schneier's ("Douglas A.
Gwyn")
Re: Random Walk (karl malbrain)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (Chris Monico)
Subject: Re: a little math please
Date: Sun, 21 Mar 99 10:59:37 GMT
In article <7cu326$ami$[EMAIL PROTECTED]>,
[EMAIL PROTECTED] wrote:
>What I would like to know, given a grid of 16x16, filled with an even
number
>of 0 and 1 bits, how many combinations are there?
>
>Not 2^256, because remember that they have to be even.
>
>Thanks,
>Tom
OK, I see a whole lot of guesses here, so let's do some _real_ math
and find the answer definitively:
(First note that this is a well known result from coding theory. If C
is a linear block code over F_2 then either all elements of C have
even Hamming weight or exactly half do. So the answer is well known is
far more generality, but I'll prove it anyway)
Clearly your grid state space is equivalent to F_2^{256}, a 256
dimensional vector space over F_2, and the equivalent question here
is:
How many elements of F^{256} have even Hamming weight? (it's
understood that F=F_2 to save typing).
Claim: Exatly half of the elements in F^{256} have even Hamming weight
(i.e., 2^{255).
Pf: First prove the following observations (they are trivial)
Let x,y\in F^{256}. Then
*w(x) odd and w(y) odd ==> w(x+y) even.
*w(x) even and w(y) even ==> w(x+y) even
*w(x) even and w(y) odd ==> w(x+y) odd
Let O={x\in F^{256} | w(x) is odd}
E={x\in F^{256} | w(y) is even}
So the claim is equivalent to |O|=|E|
I will produce an injective map, f, from O to E and an injective map,
g, from E to O.
Clearly they are both nonempty.
Fix o\in O.
Consider
f: O --> E given by
x |-> x+o
The map is clearly well-defined by the above observations. Suppose
it's not 1-1. Then there exist x,y\in O such that f(x)=f(y).
<==> x+o=y+o <==> x=y. Therefore f is 1-1.
Consider:
g: E --> O given by
y |-> y+o
Again, it's well-defined and if g(x)=g(y), we have x+o=y+o <==> x=y,
so it's 1-1.
Therefore, |O|=|E|, and so the claim is proven.
In fact, I've proven the result mentioned above. Namely that any
subspace of a finite-dimensional vectorspace contains either all even
Hamming wt vectors or exactly half. So, the correct answer is, in
fact,
2^{255} as first stated.
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: Random Walk
Date: Sun, 21 Mar 1999 18:26:18 GMT
"R. Knauer" wrote:
> On Sun, 21 Mar 1999 05:23:14 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
> wrote:
> >That's wrong. Statistical tests, properly applied and administered,
> >can provide information useful in judging the likelihood of various
> >properties of a sequence.
> I disagree. The problem is that you must assign an a priori
> probability that you do not know in order to make sense of the tests.
If the "statistical test" you have in mind requires assignment of an
a priori probability, then no wonder you're confused about this issue.
To take one of the simplest examples of a statistical test used in
randomness testing, Pearson's chi-squared, no a priori probabilities
are involved. The test is for independence of distributions.
(An improved but less well-known version, based entirely on
information theory, was developed by Kullback. The tests approach
each other for large samples, but Kullback's works down to the
smallest sample.)
Such tests are never "for" randomness, but rather "against"
randomness. I.e. if you formulate a hypothesis about uniformity
of the distribution(s), the tests can cast doubt on the hypothesis,
if the observed data doesn't match the hypothesis very well.
The degree of doubt is quantified, in the ensemble sense.
> That snake oil might be enough to satisfy the amateurs, but it doesn't
> fool physicists.
Such a statement is insulting both to professional statisticians
and to physicists.
> For someone like you who claims to understand such arcane concepts as
> Hidden Markov Models, you should most certainly undertand that even
> the slightest deviation from prefect symmetry will upset the random
> walk catostrophically. Even for p = q = 1/2, there are many anomolies
> in the random walk that defy both naive intuition and statistical
> models based on infinite steps. Origin crossing is but one of those
> "bizarre abberations" which defies the false intuition of the "law of
> averages" - whatever that is.
HMMs are hardly "arcane"; they're central to many modern applications.
Properties of random walks are quite well known and have been for many
decades. They might have been "counterintuitive" back in the 1930s,
but then so was nearly everything.
The "law of averages" is a straw man, since statisticians don't use
any such "law" -- that's a layman's notion.
There is a precise "law of large numbers", but it doesn't imply the
incorrect conclusions you seem to attribute to the "law of averages".
> Statisitcal testing of keystreams for apparent randomness is pure 100%
> virgin snake oil from the first squeezings.
No matter how often you repeat "snake oil", it doesn't make it so.
> One consideration is that if there is bias (say, p >q), we know the
> random walk will be adversely affected, which could result in a
> cryptabalyst being able to break the ciphers. It would seem,
> therefore, that the design of the TRNG should cause p < q for some
> period of generation, to offset the effects of p > q. Whether this is
> applicable and, if so, how it would be accomplished is something I am
> not equipped to address. I can only ask questions, not answer them.
> Maybe the best you can do is shut the TRNG down often, disturb it in
> some manner - like removing the radioactive source or changing out the
> diode - so that it becomes a physically different device, however
> slightly. Or maybe you could put it in an oven and blindly change the
> temperature setpoint often. Whatever.
This is a waste of time for several reasons, one being that there
is no "random walk" involved, and the other being that even for a
random-noise keystream generator, systematic bias can be removed
much more simply in a time-invariant design.
> We all know about the key management problems inherent in an OTP
> cryptosystem. But that does not stop us from addressing the security
> issues in terms of cryptanalytic attack. The OTP serves as a
> convenient paradigm for discussing the real issues surrounding our
> notions of crypto-grade security.
I don't think so. Practical systems expand a small number of key
bits into parameters for some regular scheme, wherein lie any
inherent cryptographic weaknesses of the system. Consideration
of one-time pads completely misses this point.
------------------------------
From: David A Molnar <[EMAIL PROTECTED]>
Subject: Re: Requesting Opinions, Clarifications and Comments on Schneier's Statements
Date: 21 Mar 1999 17:42:00 GMT
sb5309 <[EMAIL PROTECTED]> wrote:
> "A one-time pad might be suitable for a few short messages, but it will
> never work for a 1.54 Mbps communication channel".
> Questions :
> (b) From what I can understand from Mr. Scheier passages that, where
> there is heavy traffic, one-time pad is not practical because it is very
> expensice to generate and deliver message keys (and that is why one-time
> pad is unsuitable for long messages). How does this point relate to
> "1.54 Mbps communication channel" ?
It becomes much clearer when you find out that "Mbps" stands for
"million bits per second." Then we're talking about a stream of
1.54 million bits per second every second. By my standards 1.54
million bits is a long message. Long enough to make generating
a pad for it highly annoying.
The HotBits random number generator at http://www.fourmilab.ch/hotbits/
generates 30 bytes (240 bits) of padstuff per second. Not nearly enough
to keep up with the link, much less save enough to account for transportation
time.
-David
------------------------------
From: Jim Gillogly <[EMAIL PROTECTED]>
Subject: Re: Requesting Opinions, Clarifications and Comments on Schneier's Statements
Date: Sun, 21 Mar 1999 10:12:38 -0800
sb5309 wrote:
> Schneier's book ... on page 16 :
>
> "A one-time pad might be suitable for a few short messages, but it will
> never work for a 1.54 Mbps communication channel".
> (a) What One-time pad has got to do with the high-bandwidth ...
A high-bandwidth channel consumes key material rapidly.
> (b) From what I can understand from Mr. Scheier passages that, where
> there is heavy traffic, one-time pad is not practical because it is very
> expensice to generate and deliver message keys (and that is why one-time
> pad is unsuitable for long messages). How does this point relate to
> "1.54 Mbps communication channel" ?
A little arithmetic: 1.54Mbps (equivalent of a T1 line) is about 200K
bytes per second. If you delivered the OTP on CD's, that would be about
two dozen a day. That's a lot of high-quality random bits that you need
to generate each day. Impractical for this volume.
--
Jim Gillogly
Mersday, 29 Rethe S.R. 1999, 18:01
12.19.6.0.14, 9 Ix 7 Cumku, Fifth Lord of Night
------------------------------
From: Ted Kaliszewski <[EMAIL PROTECTED]>
Subject: On Moduli that are not quite kosher...
Date: Sun, 21 Mar 99 12:37:32 -0500
21 March, 1999
More on moduli that are not quite kosher...
Still on the subject of moduli that are products of two primes
but are readily factored: there are, indeed, several methods that
can be used to construct such moduli, few are known that will
generate a pseudoprime modulus. I have worked before with an algorithm
of Cipolla and with a proposition of Jaeschke. Recently, I have identified
a rather neat and, apparently, novel method that will generate such
moduli and also moduli that are evidently not pseudoprimes but still
easily factored.
Here is a recipe for generating such moduli:
1. Choose a prime p0, called a generator prime, of a desired
size,
2. Construct a prime p1 = k1*p0 + 1
3. Construct a prime p2 = k2*p0 + 1, k1, k2 -even integers
4. Construct a modulus n = p1 * p2
Some of the so constructed moduli will be pseudoprimes for low-valued
bases, other will not. Here is an example:
p0 = 11291741 (24 bit)
p1 = 203251339
p2 = 293585267
n = 59671598628422513 (a non-psp modulus)
p2 = 745254907
n = 151474057744070473 = psp(11)
Both of the moduli can be readily factored via the familiar ufm construct
with a multiplier of 127 (among many other values).
While none of the above solves (as yet) the general problem of factoring n
at a high bit level, it does provide a handle for recognizing a class of
moduli that are not quite kosher.
------------------------------
From: Darren New <[EMAIL PROTECTED]>
Subject: Re: Requesting Opinions, Clarifications and Comments on Schneier's Statements
Date: Sun, 21 Mar 1999 19:30:53 GMT
Jim Gillogly wrote:
> A little arithmetic: 1.54Mbps (equivalent of a T1 line) is about 200K
> bytes per second. If you delivered the OTP on CD's, that would be about
> two dozen a day. That's a lot of high-quality random bits that you need
> to generate each day. Impractical for this volume.
1.544Mbps, for them what don't know, is exactly the speed of a 1x CD ROM
drive. Hence, about 65 minutes of CD quality audio pad per CD.
--
Darren New / Senior Software Architect / MessageMedia, Inc.
San Diego, CA, USA (PST). Cryptokeys on demand.
"For efficient programs, practice featurecide regularly."
------------------------------
From: [EMAIL PROTECTED] ("Steve Myers")
Subject: Re: pRNG that is "predictable to the left"?
Date: 21 Mar 99 19:31:51 GMT
Scott Fluhrer wrote in message <7d1t5p$[EMAIL PROTECTED]>...
>In article <[EMAIL PROTECTED]>,
> [EMAIL PROTECTED] ("Steve Myers") wrote:
>>Scott Fluhrer wrote in message <7cuog9$[EMAIL PROTECTED]>...
>>>
>>>As a counterexample, consider the generator:
>>>
>>> X(n+1) = SHA( X(n) )
>>>
[snip]
>>
>>This is not hard to predict because secure hashing gives you nothing about
>>unpredictability, if I take any
>>SHA and produce SHA' s.t. SHA'(x)= 00000||SHA(x), where || is the
>>concatenation operator, then SHA' remains secure as a
>>hash function, where presumably you have some strong collision resistance
>>property that SHA needs to satisfy in order to be secure.
>>Now, if you see a string 0000 from the left, then predict the next bit is
>>0, and you will be correct with a pretty high probability (I'm assuming
that
>>SHA already does not produce a lot of strings of the form 0000 for random
x,
>>which could be formalized, but I won't take the time).
>
>You're right. One-wayness by itself does not, guarantee unpredictability.
>However, if you tighten up the definition, making a few additional
conditions
>on top of one-wayness to prevent such pathological conditions, you should
get
>the result. I could formalize these additional conditions, but I won't
take
>the time :-)
>
Sorry, I wasn't trying to be a smart aleck when I made the I won't take
the time comment, I was just pressed for time in making my response.
I don't see a way however of making non-significant changes to any of the
standard definitions of collision freedom which would allow the
the above mentioned counter example not to work. Perhaps you could
elaborate.
The requirement I would require for my hash is that the distribution on the
range of the SHA to be near uniform, which is quite common, thus the
universal in universal one-way hash function. An other question about your
example
X(n+1)=SHA(X(n)),
Surely the size of X(n+1) is smaller than X(n), so how do you extend the
size of X(n+1) to use it in the next iteration? If it is not, then SHA can
be the identity function, and satisfy all reasonable requirements of a
collision free hash. This is clearly very predictable.
>>
>>Defn of pseudo-random (extreme intuition, poor formalism) there exists no
>>(non-uniform) infinite family {C_n} of poly sized circuits, which can
>>distinguish between a random input, and the result of a pseudo-random
>>generator on a random seed with probability >= \frac{1}{n^c} for all
>>constants c, and sufficiently large n.
>>
>>Proof Sketch (Presumably the only semi-interesting Direction)
>>G is not pseudo-random=> G is not predictable from the left.
>I think you meant:
>G is not pseudo-random=> G is predictable from the left.
Yes, thanks! That is indeed what I meant.
>
>And, as the proof is equally valid in the other direction, I'll make it:
>G is not pseudo-random=> G is predictable to the left.
>
>[Valid proof snipped]
>
>
>So, what's going on here? I have demonstrated a (not pseudo-random)
>sequence that is unpredictable to the left, and you have a proof that
>non pseudo-random sequences are always unpredictable to the left.
>Well, it's actually quite simple: we're using slightly different
>definitions for predictability.
>
>In my definition, the predictor gets to look at N outputs from the
>generator (where each output is an M bit output from the generator),
>and attempt to predict the previous output (with nontrivial
>probability of success).
>
>In your definition, the predictor gets to look at N bits from the
>generator and attempt to predict the previous bit (with nontrivial
>probability of success).
>
>The distinction? In my definition, the predictor is not allowed to
>examine the bit sequence anywhere he cares to -- he has to look at
>it at an output (M bit) boundary. In your definition, the predictor
>is allowed to examine it anywhere he cares to.
>
>So, by your definition, my sequence is predictable, because if the
>predictor examines M-1 bits from X(n), and M bits from the X(n+1),
>the two possibilities for the previous remaining bit from X(n) can
>be tested quickly. Of course, by my definition, this sort of
>attack is not allowed -- the predictor gets all the bits of X(n) or
>none of them.
>
>So, it looks like we're both right (it just depends on the attack
>model) :-)
>
I'm not convinced, there is nothing in the proof that requires the bits to
be bits per say. The only requirement is that the alphabet size be of
_constant_ size, and not dependent on N, which in your example is the case.
The proof will still go through, and therefore the fact that you have to
look at these blocks rather than bits does not matter.
Steve
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: Random Walk
Date: Sun, 21 Mar 1999 19:44:42 GMT
"R. Knauer" wrote:
> In fact, there are those who argue that you can build a PRNG that
> comes very close enough to fullfilling the specification for
> generating random numbers that will thwart all known cryptanalytic
> attacks.
I have to comment that one doesn't cryptanalyze random numbers!
One cryptanalyzes traffic generated by one or more cryptosystems.
All this discussion of "randomness" is off-topic.
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: Random Walk
Date: Sun, 21 Mar 1999 19:40:36 GMT
Reply-To: [EMAIL PROTECTED]
On Sun, 21 Mar 1999 18:26:18 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
wrote:
>If the "statistical test" you have in mind requires assignment of an
>a priori probability, then no wonder you're confused about this issue.
I am not confused in the least about this issue.
I am merely reporting what the experts claim about the efficacy of
statisitcal testing to characterize randomness. I would take the time
to repeat that extensive record, some of which I have posted here, but
that would only bore the readers who have seen it once already.
For those who missed those posts, I suggest searching the Usenet
archives for key words such as "TRNG", "crypto-graderandom", etc. A
few weeks back I posted a series of quotes from a book on quantum
computing which synthesized the physicist's view of the futility of
using statistical tests to characterize random numbers. The authors
used the term "apparent randomness" to point out that statistical
tests only expose some preconceived notion of randomness which has
nothing to do with true randomness.
BTW, when I used the term "a priori probability" above I meant the
probability model. Statistical tests assume a particular model against
which to test the numbers, and the validity of those tests are based
on the limit of large numbers - the so-called frequency interpretation
of probability.
But as you should know, finite sequences are notorious for failing
such neat little tests. Putting "confidence limits" on the statisitcal
tests, based on the assumption that the tests are being applied to
infinite sequences, is simply a falacy of the first order. Kolmogorov
himself made that point very clear.
For example, in the (uniform one-dimensional) random walk, the
particle is expected to visit the origin an infinite number of times,
thereby swamping those paths that do not visit the origin. But that
only happens in the infinite limit, where all sorts of things happen
that never happen in finite walks. For sequences that are finite, the
particle rarely visits the origin.
As I quoted Feller the other day, in one particular random walk of
10,000 steps the particle visited the origin only 87 times, which
defies any statistical measure based on the law of large numbers you
can come up with. Put another way, if you had applied statistical
tests to that particular random walk, you would have rejected it as
random - yet it was a true random walk based on the Rand Tables.
>To take one of the simplest examples of a statistical test used in
>randomness testing, Pearson's chi-squared, no a priori probabilities
>are involved. The test is for independence of distributions.
>(An improved but less well-known version, based entirely on
>information theory, was developed by Kullback. The tests approach
>each other for large samples, but Kullback's works down to the
>smallest sample.)
There is an a priori assumption regarding the nature of the
distribution inherent in such statistical tests - that assumption is
based on the probability model that is chosen for the process being
tested, and gains its validity only in the infinite limit. Nobody is
claiming that infinitely long random numbers will fail appropriate
statistical tests. We full expect them to because of the law of large
numbers. But nowhere is it *certain* that finite sequences must obey
some a priori probability model and the statistical tests that result
from it.
>Such tests are never "for" randomness, but rather "against"
>randomness. I.e. if you formulate a hypothesis about uniformity
>of the distribution(s), the tests can cast doubt on the hypothesis,
>if the observed data doesn't match the hypothesis very well.
>The degree of doubt is quantified, in the ensemble sense.
That is only true in the limit of "large numbers". How "large" is
"large"? Apparently it is exceedingly large to be meaningful, like
infinitely large or nearly infinitely large. How large is that?
How many steps in the random walk are necessary before the paths begin
to behave the staitistics expected from some postulated ad hoc
probabilistic model - when the strong law of large numbers starts to
kick in a significant way? If we (correctly) expect an infinite number
of visits to the origin in the infinite limit, how many steps would
cause that probability frequency to begin to diverge? Can you safely
say that a random walk of 10^12 steps obeys statistical expectations,
or would it take 10^20 steps or perhaps 10^128 steps?
The problem with both probabilistic models based on the law of large
numbers is that they can only assign a probability that the process is
modelled correctly. As Kolmogorov pointed out, that is highly circular
reasoning. And that probability of confidence tells you nothing about
the behavior of the process for finite sequences. All it tells you is
that in the infinite limit things will happen that way - that is, the
assigned probability has validity only in the limit of infinite
sequences.
>> That snake oil might be enough to satisfy the amateurs, but it doesn't
>> fool physicists.
>Such a statement is insulting both to professional statisticians
>and to physicists.
Such a statement is nevertheless true - and maybe professional
statiticians need to be insulted, judging from the fact that they
didn't get the random walk axis crossing problem anywhere near correct
when Feller conducted his survey.
And what I am stating is not in the least insulting to physicists,
since they have been saying the same thing about random processes form
the very beginning, whether radioactive decay or Brownian motion or
even quantum mechanics itself. As a class of professionals, physicists
have the best grasp of the practical aspects of random processes.
If you would take the time to read such seminal works as those I have
cited earlier, you would see that what I say is true.
1) Li & Vitanyi on Kolmogorov Complexity;
2)Williams & Clearwater on quantum computers;
3) Feller on probability theory.
All three works give numerous examples of how finite random numbers
disobey statistical models.
>> Statisitcal testing of keystreams for apparent randomness is pure 100%
>> virgin snake oil from the first squeezings.
>No matter how often you repeat "snake oil", it doesn't make it so.
And no matter how many times you claim that I am incorrect, it doesn't
make it so. Remember that I am quoting the comments of the experts - I
am not relying on any expertise on my part. And I know I am not
"misinterpreting" what they say because I check their references and
look for independent corroberation from different fields.
Was von Neumann full of BS when he made his famous pronouncements
about the futility of attemtping to generate random numbers
algorithmically? If so, then what makes you think that a given random
number can be characterized by an algorithmic procedure such as a
statisitcal test?
If you could characterize random numbers by an algorithmic procedure
like statistical testing, then you could use that very algorithmic
procedure to generate random numbers - which would violate what anyone
with any experience in crypto knows is not the case.
Let me restate this, because I believe it is of fundamental
significance. Because you cannot generate true random numbers
algortihmically with a classical computer, you cannot contruct
algorithmic tests to decide that any given number is truly random - or
otherwise you could use that very algorithm to generate true random
numbers on a classical computer.
>This is a waste of time for several reasons, one being that there
>is no "random walk" involved,
You completely missed the point. But no matter.
>and the other being that even for a
>random-noise keystream generator, systematic bias can be removed
>much more simply in a time-invariant design.
Just how do you propose to remove this bias? And when you do, how do
you know it results in crypto-grade randomness? After all, if the
proposed method of removing bias is algorithmic then you run the risk
that its operation will destroy any true randomness that was present
before the operation was performed.
For example, the number may indeed be free from single-bit bias after
the operation, but what about other bit-group biases that might have
been "distilled" by the operation? What if in the procedure to remove
one kind of bias (e.g., 1-bit bias) you produced a higher
concentration of k-bit biases?
Bob Knauer
"If you think health care is expensive now, wait until it's FREE!"
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: Requesting Opinions, Clarifications and Comments on Schneier's
Date: Sun, 21 Mar 1999 19:55:27 GMT
sb5309 wrote:
> "A one-time pad might be suitable for a few short messages, but it will
> never work for a 1.54 Mbps communication channel".
What Bruce means is that there are practical ways to distribute
one-time pads for a *small* volume of traffic, but since a one-time
pad system requires as much key as the traffic being enciphered,
there is a significant practical obstacle to distributing key for
high-bandwidth channels with a lot of traffic. Either you use a
similar channel to transmit the key, which would have to be
encrypted, requiring another channel for *its* key, as infinitum,
or you use some alternate, secure high-density mode of "pad"
distribution such as CD-ROM via trusted courier. Neither of these
is very workable in the modern data communications context;
therefore, one-time pads are infeasible for such applications, and
we necessarily use far less key material than encrypted traffic.
------------------------------
From: karl malbrain <[EMAIL PROTECTED]>
Subject: Re: Random Walk
Date: Sun, 21 Mar 1999 19:53:51 GMT
In article <[EMAIL PROTECTED]>,
[EMAIL PROTECTED] wrote:
> I disagree. The problem is that you must assign an a priori
> probability that you do not know in order to make sense of the tests.
> Even for p = q = 1/2, there are many anomolies
> in the random walk that defy both naive intuition and statistical
> models based on infinite steps. Origin crossing is but one of those
> "bizarre abberations" which defies the false intuition of the "law of
> averages" - whatever that is.
>
>
> Yeah, but cryptanalysts back then didn't have today's technology at
> their disposal. I am sure that the Caesar cipher was a formidible
> challenge 2000 years ago, otherwise Caesar would not have used it.
>
> We all know about the key management problems inherent in an OTP
> cryptosystem. But that does not stop us from addressing the security
> issues in terms of cryptanalytic attack. The OTP serves as a
> convenient paradigm for discussing the real issues surrounding our
> notions of crypto-grade security.
>
> "If you think health care is expensive now, wait until it's FREE!"
If you'll allow me to answer from the bottom, up: You're missing the omni-
present ASSIGNMENT of PRIORITIES from your logic. Current health care is
prioritized for those who have PRIVATE COVERAGE -- it's directly related to
the amount of MONEY you can spend.
If you'll take the same ANALOGY to the OTP distribution problem, you'll get
the same results.
And again to the CAESARS -- not everyone was GIVEN the GIFT of learning to
read in the first place. TENSOR CALCULUS was as applicable then as now.
Karl M
============= Posted via Deja News, The Discussion Network ============
http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
