Cryptography-Digest Digest #317, Volume #9 Thu, 1 Apr 99 11:13:03 EST
Contents:
Re: "Biprime Cryptography" to replace RSA? (DJohn37050)
Re: Random Walk ("Douglas A. Gwyn")
Re: Live from the Second AES Conference (Jaap-Henk Hoepman)
Announce - ScramDisk v2.02h ("Sam Simpson")
Re: FSE information anyone? (Thirteen)
Re: Is initial permutation in DES necessary? ("Sam Simpson")
Re: True Randomness & The Law Of Large Numbers (Mok-Kong Shen)
Re: My Book "The Unknowable" (Paul Healey)
Re: DES or RSA Program source (C langage) (Emmanuel BRESSON)
Re: Random Walk (R. Knauer)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (DJohn37050)
Subject: Re: "Biprime Cryptography" to replace RSA?
Date: 31 Mar 1999 15:14:16 GMT
Another idea to to honor the actual inventor, Cliff Cocks of GCHQ. Something
like Cocks' Two Prime (CTB) algorithm or some such.
Don Johnson
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: Random Walk
Date: Thu, 01 Apr 1999 05:17:18 GMT
"R. Knauer" wrote:
> On Wed, 31 Mar 1999 03:32:07 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
> wrote:
> >Probability != Statistics.
> Statistics is based on probability theory.
But it explains why you never seem to find any explanation of
standard statistical concepts when you look in Feller's index.
> >For example, if one wishes to test whether two distributions
> >are correlated, the null hypothesis would be that they are not
> >correlated.
> What does comparing two distributions have to do with deciding whether
> a TRNG is not truly random?
You asked what a "point null hypothesis" meant.
I was explaining first how a "null hypothesis" is used in general.
The example was just an example, but as it happens it should be
obvious that comparison of an observed distribution against
that predicted by a theoretical model *does* have relevance
to testing presumed random-number generators.
> This reminds me of Kolmogorov's warning in the quote in Li & Vitanyi's
> book about the circular nature of statistical tests. They work only in
> the infinite limit, where all sorts of fundamentally different things
> happen compared to finite sequences.
Apparently, everything reminds you of that.
There is nothing whatever in what I said to imply that
an infinite limit is involved.
> >A "point" null hypothesis is one of the form, "parameter exactly
> >equals yay". For example, "the average speed of cars on I-95 is
> >exactly 57.000... mph". As Herman noted, this is "untenable"
> >(unless one measures the *entire* population, but it is nearly
> >impossible to have formulated such a hypothesis that turns out
> >to be correct, unless the formulator already had measured the
> >entire population).
> Isn't that the same thing I quoted in Feller's statement:
> " Thus, contrary to widespread belief, the time average for any
> individual game has nothing to do with the ensemble average at any
> given moment."
No, you entirely missed the point. Maybe that introductory
statistics textbook that so many of us have suggested you read can
explain it better. Try Triola, he's not too bad in that genre.
A non-point null hypothesis would have been, "the average speed
of cars on I-95 is greater than 57 mph". Do you see the contrast?
> >This is the basis for the rules you find for
> >choice of null vs. alternate hypotheses in introductory statistics
> >textbooks.
> Then tell us why statistics would apply to the determination of true
> randomness. It seems completely immaterial whether a TRNG fails
> statistical tests or not. The impact of Feller's comments is that
> statistics is unreliable when it comes to deciding true randomness.
"True randomness" and "TRNG" are your own notions, certainly
not standard terminology. To that extent, a "TRNG" can have
any properties you say it has, including consistently behaving
contrary to the theoretical model of random-number generation
that you claim it implements. However, nobody in his right
mind would want to use such a "TRNG" to generate the sort of
sequence that it demonstrably doesn't. Statistics allows us
to use the "TRNG"'s actual output to estimate *quantitatively*
the likelihood that the product works according to its
advertised model (which is presumably a static 0-order Markov
chain). You seem to dispute that, but you're wrong.
In fact, similar tests are routinely performed in the course
of cryptanalysis. The reason such tests work in practice is
because it is a priori *much more likely* that a detected
strong pattern is synptomatic of an actual underlying
regularity than that it happens purely by chance. (Just how
likely is computed by well-established statistical methods.)
Rational investigation demands that we pursue the most likely
possibilities first. (One can think of this as an optimal
ordering of the search tree.)
------------------------------
From: Jaap-Henk Hoepman <[EMAIL PROTECTED]>
Subject: Re: Live from the Second AES Conference
Date: 01 Apr 1999 09:56:48 +0200
[EMAIL PROTECTED] (Bruce Schneier) writes:
> >: IBM's Pankaj Rohatgi explained how he got all 128 bits of
> >: a Twofish key after only 50 (that is 50 not 2^50) uses of a smart
> >: card!
> >
> >I wonder how secure some of the other ciphers would be, if the kind of
> >optimizations Bruce suggested for fitting Twofish on a smart card were
> >applied to them. That is, if it were possible.
>
> He said in his talk that every cipher is vulnerable. We've done this
> sort of work, too, and we have found that you can't defend against
> these types of attack with the algorithm. You can do some things with
> the implementation and some things with the hardware, but basically
> you need to defend in the protocol layer.
I'm not sure I understand how a defense in the protocol layer would prevent a
DPA style attack. Could you give an example?
Jaap-Henk
--
Jaap-Henk Hoepman | Sure! We've eaten off the silver
Dept. of Computer Science | (when even food was against us)
University of Twente | - Nick Cave
Email: [EMAIL PROTECTED] === WWW: www.cs.utwente.nl/~hoepman
PGP ID: 0xFEA287FF Fingerprint: 7D4C 8486 A744 E8DF DA15 93D2 33DD 0F09
------------------------------
From: "Sam Simpson" <[EMAIL PROTECTED]>
Crossposted-To: alt.security.pgp
Subject: Announce - ScramDisk v2.02h
Date: Thu, 1 Apr 1999 09:45:24 +0100
=====BEGIN PGP SIGNED MESSAGE=====
Hash: SHA1
We are pleased to release a new build of ScramDisk - version
2.02h.
This build contains the following enhancements over 2.02g:
1) Ability to disable the "Clear cached password?" question when
quitting the application.
2) Allow fast automated shutdown under '98.
3) "Auto-execution" function added. This allows a user to run an
arbitrary data file or application when ScramDisk mounts specific
containers.
4) Several ScramDisk console applications released
This build is released with full source code and an updated User
Manual.
Please do not hesitate to contact us with any enquiries.
Regards,
Sam Simpson
Comms Analyst
- -- See http://www.scramdisk.clara.net/ for ScramDisk, a free
virtual disk encryption for Windows 95/98. PGP Keys available at
the same site.
=====BEGIN PGP SIGNATURE=====
Version: 6.0.2ckt http://members.tripod.com/IRFaiad/
iQA/AwUBNwMx/+0ty8FDP9tPEQLQvACdEPAC82GMx4M74yqNaKjwyaZUYIUAoNMz
nXyxPZ6fzSRwCbLTs6LA0xFA
=fkvW
=====END PGP SIGNATURE=====
------------------------------
From: Thirteen <[EMAIL PROTECTED]>
Subject: Re: FSE information anyone?
Date: Thu, 01 Apr 1999 01:09:09 -1000
Thirteen wrote:
>
> David Crick wrote:
> >
> > Does anyone who attended FSE (right after AES2) intend to compile
> > a brief report on it? (like we had for the two days of AES2)
Topics to be covered:
> 7 Partiers Out In an Old City at Night
>
> A Challenge to Create a Cooperative Computational Goal
>
> RC6 with constant rotation amounts
>
> Scramble All, Encrypt Small: sharing work with a smart card
>
> Miss In the Middle Attack
>
> Slide Attacks
Between sessions, people would go out to dinner or sight-see
alone or in groups. Pick pockets work the streets commonly,
I lost 50,000 lire the second night out. On Thursday I found
a woman's hand in my pocket on my wallet, a beggar and her
daughter crowding me. The Parthenon was cool looking.
At the Recent Result session, Whitfield Diffie made a request
for people to propose a Cooperative Computational Goal. Like
the factoring challenge or DES cooperative challenge it should
combine the efforts of many people in a loose network. But he
did not set the goals, he challenges us to create a goal for
teamwork. So I send out the call for proposals: what can we do
together, pooling out computing resources to acheive some
accomplishment? Create a protected zone? Enumerate all possible
types of some mathematical object that we can draw upon?
Give it some thought.
> To be continued...13
------------------------------
From: "Sam Simpson" <[EMAIL PROTECTED]>
Subject: Re: Is initial permutation in DES necessary?
Date: Thu, 1 Apr 1999 10:00:31 +0100
=====BEGIN PGP SIGNED MESSAGE=====
Hash: SHA1
Paul,
The paper "Cryptanalysis of the CFB mode of the DES with a
reduced number of rounds" by B.Preneel, M. Nuttin, V. Rijmen, J.
Buelens explains how the final permutation prevents some attacks
against DES in CFB mode.
Wouldn't the final permutation also prevent some attacks against
3DES in CFB mode?
Cheers,
- --
Sam Simpson
Comms Analyst
http://www.scramdisk.clara.net/ for ScramDisk hard-drive
encryption & Delphi Crypto Components. PGP Keys available at the
same site.
If you're wondering why I don't reply to Sternlight, it's because
he's kill filed. See http://www.openpgp.net/FUD for why!
Paul Koning wrote in message <[EMAIL PROTECTED]>...
>Christoph Haenle wrote:
>> The permutation is not done for security reasons. Rather, it
is
>> supposed to make DES implementation slower in software.
>
>I've seen the claim that it's supposed to make the hardware
>implementation more efficient. That claim has never been
>accompanied by any specifics and I don't believe it for
>a moment.
>
>> However, when
>> using 3DES, it could make a difference (in security) whether
EDE or
>> EEE is used, even when using three different keys (when using
EDE, the
>> permutations between E and D and between D and E won't
disappear as
>> opposed to the EEE scheme).
>
>Not true. It goes away either way.
>
>> As far as I know, nobody has ever proven
>> whether of not the permutations strenghens 3DES.
>
>Not so; it's entirely obvious that it does nothing useful
>at all. Explaining why would be a good easy homework
>problem for Cryptography 101.
>
> paul
=====BEGIN PGP SIGNATURE=====
Version: 6.0.2ckt http://members.tripod.com/IRFaiad/
iQA/AwUBNwM1qu0ty8FDP9tPEQL1RwCggJudhPJUDgEWwQIoTpPIsuAMudUAoIFW
6UqisyG77h5jt9ShXlPgYy9d
=yf2m
=====END PGP SIGNATURE=====
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: True Randomness & The Law Of Large Numbers
Date: Thu, 01 Apr 1999 11:25:20 +0100
R. Knauer wrote:
>
> The only way you can have any reasonable confidence in the performance
> of a "real TRNG" is to audit the design carefully and run diagnostics
> on each subsystem using methods that define its performance. And that
> includes the quantum mechanical source of true randomness, like
> radioactive decay. Even though statistical tests cannot be used on the
> output, you can run definitive tests on the quantum system to make
> sure it is performing properly. That's because you are not trying to
> infer randomness from those tests.
>
> IOW, those tests are confirming that the quantum system is passing the
> randomness thru properly. That's especially troublesome for detecting
> radioactive events because of deadtime errors. You want to run tests
> to make sure that deadtime is not a problem. But that does not mean
> you are testing the quantum system for randomness. You are relying on
> the fact that the quantum system is truly random based on quantum
> mechanics.
>
> There is one exception to that is the Mossbauer spectrum of a truly
> randomly decaying isotope. It's shape is Lorentzian if the decay
> process is truly random. IOW, you can use the lineshape to demonstrate
> the truly random nature of that particular isotope's decay process.
>
> Truly random radioactive decay is the result of spontaneous emission
> which is governed by second order perturbation theory in quantum
> mechanics. That is where the true randomness comes from and that is
> where the Lorentzian lineshape comes from. They are intimately related
> to one another in quantum perturbation theory.
>
> The Fourier transform of a Lorentzian is a simple exponential, which
> is also the result of a truly random process in that it comes from a
> first order rate equation with a constant probability per unit time -
> which makes the time of decay independent and equidistributed, two
> properties of a TRNG.
We have discussed many times in the past on the issue of doing (any)
tests but unfortunatedly it hasn't been cleared up. Hence I am
taking the liberty to raise one basic point once again. If you do any
tests involving gathering data from physical phenomena, some measuring
apparatus is involved. That apparatus has certain (non-perfect)
precison and has certain range of errors. So the results are only
acceptable with certain level of confidence and one is thus back to
statistics, as far as I can see. (To determine the precision
of the appratus itself needs the invocation of theory of statistical
tests!)
M. K. Shen
------------------------------
From: Paul Healey <[EMAIL PROTECTED]>
Crossposted-To: sci.math,sci.physics,sci.logic
Subject: Re: My Book "The Unknowable"
Date: Thu, 1 Apr 1999 10:35:55 +0100
In article, karl malbrain <[EMAIL PROTECTED]> writes,
>
>Paul Healey <[EMAIL PROTECTED]> wrote in message
>> (...)
>> What is unknowable ? Maybe it is randomness. In that case I do not see
>> how you can end the game ! Is a syllogism or equivalence relation, a
>> method of reasoning that allows you to reason ?
>
>UNKNOWABLE along this thread attempts to tie OWNERSHIP to INFORMATION. I
>believe the original author's work mistakes MATERIAL ownership with
>USABILITY (ability to apply information to material things)
'Tie', implies they can be unbound. Does not attempting to tie
information with data, confound reason ? - one is the essence of the
other. Essence cannot be applied to anything. Information is subjective,
in that it requires data. Data is objective, in that you can own it or
use it. Winning the game, or knowing its rules implies information is a
a piece of data. Likewise, data has no value without information.
Your ability to play the game, depends on a method of reasoning that can
be applied to it. Application implies a method, and this can be
associated with a patent or copyright.
>
>>
> > As such, can I not define it as merely a principle? So, is the
>> principle a ground ? I would say, it is merely dialectical to assert
>> your ground - you can reason either way is in no doubt. If I up the
>> ante, within connectionist logic(my understanding of it), winning the
>> game so to speak, is not so easy.
>
>Here you fall into VULGAR MATERIALISM. Material is Paramount, not
>Information (which accumulates as a function of TIME)
>
Materialism for-itself is vulgar, so vulgar materialism is for-itself -
the principles which belong to it cannot be discerned by its own schema.
It presents itself as if this is the way things actually are, but in
fact it is only concerned with the appearance of things. It is just a
more modern variant of empiricism, as Hegel points out ! Both are
ethically suspect, just as transcendental logic is, in that they fail to
ground their schema's. If 20th century logicians, had more respect for
philosophy, no doubt our universities would be less like monasteries and
more like oracles.
Nothing is unknowable, precisely because it is nothing more than a word.
Though I do not doubt, that language allows you to argue otherwise:
what exists is unknowable and unthinkable etc., as Georgias argued in
"What is Not". Arguing some thoughts are not real; Syclla and
Chimaera's, negates the notion that thought is being - it presupposes
one can think without being conscious. It also implies some beings are
not real. Being belongs to thought is ad hominem - by assuming thought
is material; can belong to it, there is an address to the feelings and
prejudice of the hearer. What Georgias, like many a modern logician
fails to do, is differentiate between what a thing is in-itself and that
which it belongs to. Constructing a schema which can do this, which is
categorically consistent, I claim has a ground, whereas an arbitrarily
set of axioms is merely a correspondence with what things are in-
themselves. This is why, axiomatic deductive models of reasoning fail to
capture the dynamic nature of reasoning as it is related to language;
you can have a dialogue with someone else, precisely because you have
some idea, or can work out and learn what they mean. This requires, that
what exists has to be knowable.
--
Paul Healey
------------------------------
Date: Thu, 01 Apr 1999 09:35:27 -0500
From: Emmanuel BRESSON <[EMAIL PROTECTED]>
Subject: Re: DES or RSA Program source (C langage)
Hi,
You have PASCAL sources about large integers here:
http://ace.ulyssis.student.kuleuven.ac.be/~triade/GInt/gint.html
good luck !!
--
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: Random Walk
Date: Thu, 01 Apr 1999 14:44:07 GMT
Reply-To: [EMAIL PROTECTED]
On Thu, 01 Apr 1999 05:17:18 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
wrote:
>The example was just an example, but as it happens it should be
>obvious that comparison of an observed distribution against
>that predicted by a theoretical model *does* have relevance
>to testing presumed random-number generators.
AHA! Now we are getting somewhere.
Just exactly what is that purported "theoretical model" for true
randomness that you just spoke of? Is it really a theoretical model
for true randomness, or is it really a model for pseudorandomness?
>No, you entirely missed the point. Maybe that introductory
>statistics textbook that so many of us have suggested you read can
>explain it better. Try Triola, he's not too bad in that genre.
I just might do that. I am very curious to discover where
statisticians get the notion that they can algorithmically compute the
properties for true randomness.
The most random thing in the Universe, the so-called "collapse of the
wave vector", cannot be determined algorithmically - to do so would
require "hidden variables", which are known not to exist. True
Randomness is something that cannot be calculated by an algorithmic
model. Neither can non-true-randomness.
>"True randomness" and "TRNG" are your own notions, certainly
>not standard terminology.
That is not correct. We had an extensive debate on what constituted a
True Random Number Generator about 1 1/2 years ago, and the
terminology and specifications for a TRNG that I have been using here
came from the prevailing consensus of that debate.
If you have a significant improvement to make, then we will certainly
incorporate it into the specification. But it will require a consensus
approval of people on sci.crypt.
The term "true randomness" comes directly from quantum mechanics. For
example, see the book by Williams & Clearwater on quantum computing.
As you can see clearly below, the very chapter title is "True
Randomness".
So quit trying to make it look like I made these terms up. I did not
make them up - they come from other people, experts at that.
+++++
"Explorations In Quantum Computing" by Colin Williams and Scott
Clearwater", chapter 7 entitled "True Randomness":
"Today our best description of Nature is in terms of quantum physics.
Quantum physics, as we currently understand it, relies heavily on the
concept of randomness."
"... a classical computer can only *pretend* to generate a random
number whereas a quantum computer can *actually* generate a random
number."
"... there is no such thing as *a* random number. It only makes sense
to talk about processes for generating sequences of random numbers."
"... we are faced with the question of whether a particular sequence
of numbers has the *appearance* of being random. Fortunately, there
are statistical tests that can answer this question."
"The art in creating computer programs that simulate the generation of
true random numbers is to devise algorithmic methods that generate
sequences of numbers that pass both the distribution test and
correlation checks. As we show, even when random number generators
pass such statistical tests, the sequence of numbers it generates may
still not be random enough to serve as an approximation to a true
random process."
+++++
>To that extent, a "TRNG" can have
>any properties you say it has, including consistently behaving
>contrary to the theoretical model of random-number generation
>that you claim it implements.
I have never posited any "theoretical model of random-number
generation". The only thing I have given is a *specification* for a
TRNG, and one physical implementation (radioactive decay).
The specification for a TRNG is that it is a process which is capable
of generating all possible finite sequences equiprobably, namely in an
independent and equidistributed manner. If you want to model that with
a uniform Bernoulli process, then it is up to you to demonstrate that
a UBP meets this specification. If you want to build an actual TRNG,
you likewise must demonstrate that it meets this specification.
Statistcial testing of the output of a TRNG will not demonstrate that
the specification is actually met - all it can do is alert you to the
*possibility* that the process does not meet that specification. You
have to look elsewhere to make a reasonable determination.
>However, nobody in his right
>mind would want to use such a "TRNG" to generate the sort of
>sequence that it demonstrably doesn't.
A TRNG is reasonably certified to meet the specifications for true
random number generation not by statistical tests, but by virtue of
its design and by diagnostic tests on its subsystems. A TRNG must be
treated like a piece of scientific equipment, and certified in the
same manner as an experimental scientist reasonably certifies that his
equipment is performing to specification.
Nobody in his right mind woud want to use the output of the experiment
as means of characterizing the proper functioning of the equipment. To
do so would be tantamount to professional suicide. Yet that is exactly
what you propose when you claim that the output of a TRNG can be
tested statistically to characterize the non-randomness of the TRNG.
If you don't see that such a program is sheer folly, I urge you not to
enter the experimental sciences.
>Statistics allows us
>to use the "TRNG"'s actual output to estimate *quantitatively*
>the likelihood that the product works according to its
>advertised model (which is presumably a static 0-order Markov
>chain). You seem to dispute that, but you're wrong.
I has been my understanding that a static 0-order (I thought it was
1st order, but evidentally I am mistaken) Markov chain is the same as
a Uniform Bernoulli Process (UBP).
What quantitative property of that process is it that you are
purporting to measure quantitatively - bit group bias, perhaps? If so,
I will concur that the complete ensemble of sequences must exhibit no
bit-group bias. But I will not agree that sampling an infinitesimally
small fraction of sequences suffices.
And notice how you hedged your comment above with terms like
"likelihood" and "presumably". Those are words used in diagnosis, not
in characterizing something as reasonably certain.
All that your beloved statistical tests can do is compare the output
of a TRNG to a standard model for pseudorandomness - which as Williams
& Clearwater state above, is not adequate for characterizing true
randomness in the real world.
>In fact, similar tests are routinely performed in the course
>of cryptanalysis. The reason such tests work in practice is
>because it is a priori *much more likely* that a detected
>strong pattern is synptomatic of an actual underlying
>regularity than that it happens purely by chance.
I have never disagreed with that. That is why I am quite willing to
accept that statistical test are useful in diagnostics.
But the reason you accept the hypothesis that such tests allude to is
that there are other more crucial factors at work. For example, if the
cipher is significantly longer than the key, you know that there is
only one intelligible message that can be decrypted. You may use
statistical inference to discover it, but the reason you accept it as
the reasonably correct decryption is not because of the statistical
tests, but because you know it must be the message for other reasons.
>(Just how
>likely is computed by well-established statistical methods.)
I have no quarrel with statistical methods of induction, like the
Bayesian method discussed in Li & Vitanyi. But I will not accept the
notion that such methods result in reasonably certain truth. It takes
more to arrive at reasonable certainty than statistical models.
>Rational investigation demands that we pursue the most likely
>possibilities first. (One can think of this as an optimal
>ordering of the search tree.)
One can also think of it as "pac"-learning - "probably approximately
correct" learning. Occam's Razor is based on that kind of inductive
learning. But physical laws are not accepted solely on the basis of
Occam's Razor. They are accepted only after the amount of supporting
evidence is overwhelming, and there is absolutely no contrary evidence
to be found.
Just ask why it is that after nearly a century of investigation by the
best minds on Earth, no one has advanced a satisfactory mathematical
explanation for the true randomness found in quantum physics. Could
that be taken as prima facie evidence that true randomness or its lack
cannot be calculated mathematically?
Bob Knauer
"The laws in this city are clearly racist. All laws are racist.
The law of gravity is racist."
- Marion Barry, Mayor of Washington DC
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
