Cryptography-Digest Digest #338, Volume #9 Sun, 4 Apr 99 17:13:03 EDT
Contents:
Re: "Kryptos" sculpture ("Douglas A. Gwyn")
Re: Is initial permutation in DES necessary? ("Douglas A. Gwyn")
Re: Announce - ScramDisk v2.02h (Liberty)
Re: True Randomness & The Law Of Large Numbers (Herman Rubin)
Re: True Randomness & The Law Of Large Numbers (R. Knauer)
Re: True Randomness & The Law Of Large Numbers (R. Knauer)
Re: True Randomness & The Law Of Large Numbers (R. Knauer)
Re: True Randomness & The Law Of Large Numbers (R. Knauer)
--- sci.crypt charter: read before you post (weekly notice) (D. J. Bernstein)
Re: Methods of exchanging Secret Keys ... (David P Jablon)
Re: Alert: "HAPPY99.EXE" e-mail/newsgroup virus (Kurt Wismer)
Re: Diffie Hellman - avoiding the man in the middle (David P Jablon)
Re: True Randomness & The Law Of Large Numbers (R. Knauer)
Re: Extending a hash? (David P Jablon)
----------------------------------------------------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: "Kryptos" sculpture
Date: Sun, 04 Apr 1999 18:24:16 GMT
[EMAIL PROTECTED] wrote:
> > Has anyone published other clues about the Kryptos sculpture that
> > stands in front of the CIA building?
> What is the sculpture?
You can find out about it by Web-searching for CIA & Kryptos.
> Wouldn't it be easy to use a OTP or other cipher (RC4 with 256 bit
> key...) and have no one ever crack it?
What does that have to do with Kryptos?
In fact, most of it is clearly not enciphered with a OTP,
and it is nearly certain that RC4 was not used.
I made the transcript of the Kryptos ciphertext you sometimes see
floating around the net..
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: Is initial permutation in DES necessary?
Date: Sun, 04 Apr 1999 18:27:25 GMT
Sundial Services wrote:
> I believe that as time goes by and some of the attacks on DES are
> re-discovered by the public, it has become quite clear that the design
> was a very good one... and still is. It does, indeed, give excellent
> security to all kinds of data -- not against the NSA, perhaps, but good
> enough to be the linchpin of financial dealings worldwide.
In the context of 3DES, but no longer as a single DES layer.
If enough money is at stake, the small investment now needed
to build a DES cracker would no longer pose a serious
obstacle. A decade ago, it was still beyond most budgets.
------------------------------
From: Liberty<[EMAIL PROTECTED]>
Crossposted-To: alt.security.pgp
Subject: Re: Announce - ScramDisk v2.02h
Date: Sun, 04 Apr 1999 19:12:39 GMT
Ghostly1 <[EMAIL PROTECTED]> wrote:
>
> For anyone to criticize Scramdisk suggests some hidden agenda. Maybe to
> deliberately piss you off sufficiently that you will drop it. Perhaps that is
> my paranoia showing, but don't let 'em stop you, Aman. This program is truly
> excellent.
>
Nah lets not go to far. I use Scramdisk and am pretty convinced that its
the best product of its kind out there. However, it is a crypto product. I
want and apreciate the folks that tear into it dig and try to expose any
possible security flaws. so that I can address them or make any adjustments
thay are neccassry.
Actually there was a point to be made in this thread, and one that can help
with understanding. The point was the option of 10 enryption algorithms
doesn't mean that it has 10 times the security. I also realized that
although I might be using Blowfish, If everyone else is using Blowfish I
may get more security by using another algorythm.
Another issue with Critisism is that it canlead to some improvements of the
the software. If some one thinks they might have a better way, or that
Amman did something incorrect, they should bring it up. Who knows it might
lead to a better product. I would think that anyone trying to crack a
ScramDisk partition would start with Blowfish first because if its
commonality.
That being said:
Amman also deserves to be treated respect, He gave us a very fine
program. IMHO The best of its kind available to windows owners at any
price. There is no reason to personally attack him or his abiltiies. He has
given us a gift that we can use if we want, and he owes us nothing. No
fixes, no explanations, nothing. We can apreciative of what he has put out
and his efforts.
--
Liberty ...
=================================================================
Liberty :Freedom is first earned
[EMAIL PROTECTED] :by demanding it. It's lost by
:forgetting its value.
=================================================================
------------------------------
From: [EMAIL PROTECTED] (Herman Rubin)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: 4 Apr 1999 13:35:52 -0500
In article <[EMAIL PROTECTED]>,
R. Knauer <[EMAIL PROTECTED]> wrote:
>On Sat, 03 Apr 1999 10:10:06 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
>wrote:
.................
>If you are talking about a physical device then you must treat it like
>a piece of scientific equipment and certify its performance using
>accepted scientific techniques, including a peer-reviewd design audit
>and diagnostic tests for each subsystem.
The certification of performance needed depends on the purpose.
If you want to measure something to 1 part in 10^6, it is not
enough to certify that the equipment measures to 1 part in 10^3.
To certify a random device takes more than the square of the
accuracy needed, unless one makes VERY strong assumptions.
It is from those who work with the physical devices that I
question the possibility of getting the desired accuracy.
There are hopefully ways that one can improve things.
--
This address is for information only. I do not claim that these views
are those of the Statistics Department or of Purdue University.
Herman Rubin, Dept. of Statistics, Purdue Univ., West Lafayette IN47907-1399
[EMAIL PROTECTED] Phone: (765)494-6054 FAX: (765)494-0558
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: Sun, 04 Apr 1999 19:31:37 GMT
Reply-To: [EMAIL PROTECTED]
On Sun, 04 Apr 1999 04:45:46 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
wrote:
>Absolute security of an OTP keystream against any possible attack
>under any possible circumstances requires more than can be
>expressed in such terms; see what I said in that earlier paragraph.
If the keystream is truly random and is never used more than once, the
OTP system is proveably secure. That is the only possible circumstance
and constitutes the only terms that need to be expressed.
>More importantly, in practice, the actual operation of the OTP
>system usually falls short of the intended operation, thereby
>giving the cryptanalyst something to exploit. The VENONA case
>provides one example of this.
Venoma was broken because the keystream was used more than once.
>I've broken what might be genuine OTP systems myself (at
>least, I never did find any regularities in the key streams).
>It would not have mattered in the least had the keystreams
>been generated by your so-called "TRNG".
If the keystreams had been generated by a properly functioning TRNG,
you could have not cracked the ciphers. There would have been no way
for you to have reasonable certainty that the purported decryption was
the intended plaintext. All possible plaintexts are equiprobable if
the keystream is truly random and only used once.
BTW, I am fully appreciative of the fact that one can use
non-parametric methods to crack stream ciphers. One does not have to
know the actual distribution of the keystream generator, nor does one
have to model it. However, if the keystream generator is truly random,
like the output from a quantum computer built to meet the
specifications for a TRNG, then there is no way you can decrypt an OTP
cipher if the keystream is never reused.
>It is almost pointless to analyze cryptography from the OTP
>point of view, since the impracticalities of key management
>mean that in practice OTPs are almost never used.
The OTP is unique in that it is the only proveably secure classical
cryptosystem, and serves as the ideal system for purposes of
discussion. There is no attempt to pawn it off as a practical system
in these discussions.
Bob Knauer
"The brave men who died in Vietnam, more than 100% of which were
black, were the ultimate sacrifice."
- Marion Barry, Mayor of Washington, DC
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: Sun, 04 Apr 1999 19:31:42 GMT
Reply-To: [EMAIL PROTECTED]
On Sun, 04 Apr 1999 09:32:09 -0400, "Trevor Jackson, III"
<[EMAIL PROTECTED]> wrote:
>Really. Either name one or retract this statement.
Debate by its very nature is a sport, and it is not sporting to deride
your opponents on an individual basis.
The statement stands or falls on its own merits. And this debate is
far from over - hell, I don't even see the fat lady anywhere.
Bob Knauer
"The brave men who died in Vietnam, more than 100% of which were
black, were the ultimate sacrifice."
- Marion Barry, Mayor of Washington, DC
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: Sun, 04 Apr 1999 19:31:40 GMT
Reply-To: [EMAIL PROTECTED]
On 4 Apr 1999 09:17:53 GMT, [EMAIL PROTECTED] (Bryan G. Olson; CMSC (G))
wrote:
>Can you quote where FIPS-140 says that? Note that saying to
>reject a generator that fails statistical tests is not the
>same thing.
I claim that there are only two valid sets for randomness:
Set #1: Reasonable certainty that the process is not random;
Set #2: Processed which do not exist in set #1.
Put into the language of statistics:
Null Hypothesis: A particular RNG is not random.
Alternate Hypothesis: That particular RNG is random.
There is no middle set of RNGs that are maybe random, maybe not random
on the basis of reasonable certainty. There is a definite area outside
the Z-score and a definite related area inside the Z-score. There is
no gray zone where things may be or may not be simultanously.
Therefore, it a RNG fails those statistical tests, it is reasonably
certain that it is not random, and if it does not fail those tests, it
is reasonably certain that it is random. If you claim that there is a
third set of maybe/maybe-not, then there can be no set of TRNGs that
are reasonably certain to be non-random.
You can't have it both ways. Either a TRNG can be determined to be
non-random, in which case there is no set of maybe/maybe-not random
TRNGs, or the opposite is the case and then your tests are worthless.
Bob Knauer
"The brave men who died in Vietnam, more than 100% of which were
black, were the ultimate sacrifice."
- Marion Barry, Mayor of Washington, DC
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: Sun, 04 Apr 1999 19:31:41 GMT
Reply-To: [EMAIL PROTECTED]
On Sun, 04 Apr 1999 09:29:24 -0400, "Trevor Jackson, III"
<[EMAIL PROTECTED]> wrote:
>> Berry Paradox: "True randomness cannot be described."
>> But that statement itself is a description of true randomness.
>No, it is not.
See Chaitin for a more rigorous version of Berry's Paradox.
>The moral equivalent of peer review. Logically it consists of a
>comparison of the device against the known weaknesses of other devices.
>E.g., Is the device deterministic? Does it have bias, or worse drift?
>Is it well insulated (against an adversary influencing the output)?
>Does the implementation actually follow the original design?
>These are issues that the designed *shuould have* considered prior to
>the construction of the device. Once the device exists and is operable,
>all of the issues need to be reviewed, and the operation compared to the
>predicted pattern (not the output, the mechanism: data rate, operable
>temperature range, etc.)
I am in full agreement with all you just said, because it is standard
practice for good experimental scientists. And the program works well,
too - just look how cold fusion was rapidly debunked.
Bob Knauer
"The brave men who died in Vietnam, more than 100% of which were
black, were the ultimate sacrifice."
- Marion Barry, Mayor of Washington, DC
------------------------------
From: [EMAIL PROTECTED] (D. J. Bernstein)
Crossposted-To: talk.politics.crypto
Subject: --- sci.crypt charter: read before you post (weekly notice)
Date: 4 Apr 1999 06:00:36 GMT
sci.crypt Different methods of data en/decryption.
sci.crypt.research Cryptography, cryptanalysis, and related issues.
talk.politics.crypto The relation between cryptography and government.
The Cryptography FAQ is posted to sci.crypt and talk.politics.crypto
every three weeks. You should read it before posting to either group.
A common myth is that sci.crypt is USENET's catch-all crypto newsgroup.
It is not. It is reserved for discussion of the _science_ of cryptology,
including cryptography, cryptanalysis, and related topics such as
one-way hash functions.
Use talk.politics.crypto for the _politics_ of cryptography, including
Clipper, Digital Telephony, NSA, RSADSI, the distribution of RC4, and
export controls.
What if you want to post an article which is neither pure science nor
pure politics? Go for talk.politics.crypto. Political discussions are
naturally free-ranging, and can easily include scientific articles. But
sci.crypt is much more limited: it has no room for politics.
It's appropriate to post (or at least cross-post) Clipper discussions to
alt.privacy.clipper, which should become talk.politics.crypto.clipper at
some point.
There are now several PGP newsgroups. Try comp.security.pgp.resources if
you want to find PGP, c.s.pgp.tech if you want to set it up and use it,
and c.s.pgp.discuss for other PGP-related questions.
Questions about microfilm and smuggling and other non-cryptographic
``spy stuff'' don't belong in sci.crypt. Try alt.security.
Other relevant newsgroups: misc.legal.computing, comp.org.eff.talk,
comp.org.cpsr.talk, alt.politics.org.nsa, comp.patents, sci.math,
comp.compression, comp.security.misc.
Here's the sci.crypt.research charter: ``The discussion of cryptography,
cryptanalysis, and related issues, in a more civilised environment than
is currently provided by sci.crypt.'' If you want to submit something to
the moderators, try [EMAIL PROTECTED]
---Dan
------------------------------
From: [EMAIL PROTECTED] (David P Jablon)
Subject: Re: Methods of exchanging Secret Keys ...
Date: Sun, 4 Apr 1999 20:02:36 GMT
In article <7dmso0$2qi$[EMAIL PROTECTED]>,
John <[EMAIL PROTECTED]> wrote:
> Besides the obvious method in exchanging secret keys i.e. A tells B password
> or Public Key methodology for secret key exchange, are there any other ways
> that secret keys can be exchanged.
SPEKE, EKE, and SRP-3 are all ways to negotiate a large
session key based on a small or low entropy shared key.
These methods prove knowledge of a password and create
a mutually passsword-authenticated session key without revealing
the password.
SPEKE other subtle public key tricks are described at:
<http://world.std.com/~dpj/links.html>
-- dpj
------------------------------
Crossposted-To:
comp.lang.pascal.delphi.misc,comp.databases.paradox,comp.databases.ms-access
From: [EMAIL PROTECTED] (Kurt Wismer)
Subject: Re: Alert: "HAPPY99.EXE" e-mail/newsgroup virus
Date: Sun, 4 Apr 1999 18:40:10 GMT
Cameron McCormack ([EMAIL PROTECTED]) wrote:
: I see they've arrested the guy who wrote the virus. He was charged with
: five offences (can't remember what they were), and if he was sentenced to
: the maximum possible extent for each offence, he'd get 40 years in prison!
honk!... sorry, try again... they got the guy who posted the melissa
macro virus... the creator of the happy99.exe worm is someone else
entirely ...
--
"when i ran i didn't feel like a runaway
when i escaped i didn't feel like i got away
there's more to living than only surviving
maybe i'm not there but i'm still trying"
------------------------------
From: [EMAIL PROTECTED] (David P Jablon)
Subject: Re: Diffie Hellman - avoiding the man in the middle
Date: Sun, 4 Apr 1999 20:18:19 GMT
In article <[EMAIL PROTECTED]>,
Peter Gunn <[EMAIL PROTECTED]> wrote:
>DJohn37050 wrote:
>
>> See IEEE P1363 for a discussion of all/most of these things. There are many
>> details you are missing that could make things insecure.
>> Don Johnson
> [...]
> So, here are my conclusions so far...
> [...]
>* only way to avoid the 'man in the middle' is to check a
> 'certificate' he supplies with some trusted third party.
There are other ways to authenticate Diffie-Hellman,
such as by using shared keys, and even small shared keys.
While you're at the P1363 web site, check out the
P1363a submissions on SPEKE and SRP-3. More papers
are at <http://world.std.com/~dpj/links.html>.
SPEKE is a simple protocol where the base is chosen
as a function of a secret password.
>There is no mention of 'strong' or 'weak' primes? So, I guess
>this isnt important? For now, I'll probably just nick a
>1024bit one from someone else, and generate my own later on.
It might be very important. A "safe" prime p, where
(p-1)/2 is also prime, is often recommended, and you'll want
to prevent subgroup confinement. There are many ways to do this.
Keep on reading.
-- dpj
------------------------------
From: [EMAIL PROTECTED] (R. Knauer)
Subject: Re: True Randomness & The Law Of Large Numbers
Date: Sun, 04 Apr 1999 19:31:38 GMT
Reply-To: [EMAIL PROTECTED]
On 4 Apr 1999 09:13:35 GMT, [EMAIL PROTECTED] (Bryan G. Olson; CMSC (G))
wrote:
>I haven't written anything that implies no statistician will write
>about abnormal phenomena or fluctuations. You simply have not
>understood what theory applies where.
I am not alone. Everyone here has assumed that the pseudo-random model
applies to true random number generation. I claim that such an
assumption is unfounded, and is actually incorrect. I cannot prove
that, since I am not an Expert. I am an Informed Layman (tm) and the
best I can do is play Devil's Advocate. And one of the priviliged
advantages I have is that because I am not an Expert, I can readily
admit when the position I have taken is wrong. I have no professional
ego to defend.
I claim that true randomness cannot be modeled by classical analytical
processes like those discussed in standard statistics. One must go to
processes that are quantum mechanical in nature, and that means a
completely different kind of statistics, namely quantum statistics,
which has very little to do with standard statistics.
>And to show that your predictions about a random walk are wrong,
>we certainly don't need to.
I did not introduce the random walk to make predictions, only to point
out that even pseudo-random notions can be counter-intuitive.
I tried to create an analogy with random number generation when I
discussed the characteristics of the gaussian, something which you and
others showed me is not appropriate. One cannot fabricate a correct
analogy with the gaussian to point out that true random number
generation is not pseudo-random. It will take other considerations
than that.
Therefore I am now going to drop any further considerations of the
random walk because it is getting us nohwere. Anyway, I had to return
Feller's book to the library, so I can't refer to it anymore.
>: IOW, I am challenging your contention that true randomness can even be
>: modeled mathematically, even to the extent that you can determine with
>: reasonable certainty tbat a process is not truly random based on
>: statistical tests.
>But your doing it by not defining your terms.
I believe I have.
True randomness is a process which is capable of generating all
possible finite sequences equiprobably, namely in an independent and
equidistributed manner.
What terms do you think I have not defined in that specification
above?
>O.K.; I'll bite. First I challenge you to define what you mean.
I just did above when I gave the specification for a TRNG.
>I'll assert that statistical hypothesis testing can show that some
>bad candidate TRNGs are in fact bad.
You can only do that if the Central Limit Theorem (CLT) applies. All
of classical statistics, even non-parametric statistical tests,
require that the CLT applies. If, however, a distribution is not
square integrable all the way to infinity, for example, then the CLT
is not applicable and all your beloved statistical tests, parametric
and non-parametric alike, go straight to hell in a handbasket.
>Now precisely how can you use
>this to deterministically generate true random numbers?
I would use it to cull sequences that did not pass your statistical
tests. A given set of sequences is either random or not based on your
tests. There cannot be a third category of "maybe random, maybe not
random. If that were the case, then your tests for non-randomness
would not be reasonably certain. So if a given set of sequences is not
rejected, it must therefore be random based on your tests.
If your tests cannot tell me that a set of sequences is non-random
with reasonable certainty, then they are useless (except maybe as
diagnostic aids).
>WhileI've merely read about the fundamentals of probability and
>statistics. I've found that understanding a little is better than
>cataloging a lot. I've often joked that I have a friend who's into
>Chaos Theory, only he thinks the point is that we must find and kill
>some butterfly.
Do you fully understand all the assumptions upon which the CLT is
based? Do you fully understand that all of standard statistics is
based on the CLT? Do you fully understand that if a distribution does
not meet the conditions for the validity of the CLT, then standard
statistical tests do not apply?
>Given any reasonable estimate on the probability that the TRNG
>is broken in such a way as to produce 80 zeros in a row, I
>quantify a lower bound on the probability that the candidate
>TRNG is broken, and that probability will be close enough to one
>that I can safely reject it.
You are using pseudo-randomness as the criterion for rejecting the
TRNG. Can you give fundamental reasons why you believe that
pseudo-randomness is a correct model for true randomness, if even only
as a necessary condition?
>Again, I must point out the importance of quantitative reasoning.
>How long you've known what and the loneliness out there will not
>help us answer the question. One hundred standard deviations
>will.
Only if the distribution is the kind for which the CLT is applicable.
If the distribution is not square integrable, then the CLT does not
apply, and your beloved 100 standard deviations have no meaning.
For example, what if the distribution is flat? That is not a square
integrable distribution when extended to infinity, and therefore the
CLT does not apply. That means that all your statistical tests are
invalid, across the board - because they are all crucially dependent
on the CLT.
Could the distribution for the TRNG process be such a flat
distribution, a constant value in the entire sample space? Consider
this model for a TRNG:
I prepare one sample space for each kind of n-bit sequences by putting
each of the possible sequences in a jar. There are 2^n such balls of
each kind (with n-bits), and the full ensemble is obtained if there is
exactly one of each ball of each kind of possible sequence. So far I
have meet one of the specifications for a TRNG, namely that the
ensemble is made up of all possible finite sequences. If there is one
and only one instance of each possible sequence in the jar, then they
are also equidistributed. All that is left is to meet the condition of
independent selection.
I shake the jar up to randomize it. Now I am reasonably certain that
if I reach in and grab one sequence, that the selection process is
independent.
What is the distribution for such a process? Well, the first thing to
note (which I think is of critical importance) is that the sequences
are all distinguishable. No two sequences are the same in terms of the
use as keys in the OTP system. Therefore there is no binomial
distribution.
The binomial distribution is produced when sequences are considered to
be combinations of bits, not permutations of bits. For example, for
3-bit sequences we have 8 possible sequences:
000, 001, 010, 011, 100, 101, 110, 111
Considered as combinations, there is one with no 1s (000) , one with
no zeros (111), three with one 1 (001, 101, 100), and three with one 0
(011, 101, 110). Treating the three sequences with one 1 all the same
gives rise to the binomial distribution.
If the sequences are not treated in groups of the same kind, then the
distribution is not binomial, but is a flat distribution. But that is
precisely the specification of a keystream generator, because each
sequence is unique for purposes of crypto.
If the key is 101, that is not the same as 110 or 011. Those are three
separate keys, each leading to different ciphertexts. It is a
fundamental error to treat bit-grouped sequences the same just because
they have some property that makes them *appear* to be the same.
In fact, that is what is meant by pseudo-randomness, namely that
bit-groups of sequences appear to be the same by virtue of having the
same number of 1 bits. Treating sequences on the basis of the same
count groups of 1 bits is to group them into a binomial distribution.
But clearly that is not the proper way to look at sequences for
crypto, because bit-grouped keys with the same number of 1 bits are
not all the same in terms of the ciphers they produce. If 001, 010 and
100 were all the same key for purposes of encryption, then the
resulting three ciphers would all decrypt to the same plaintext. But
we know that is not the case for the OTP system.
Therefore pseudo-randomness, which comes from bit-groups and the
resulting binomial distribution, is fundamentally incorrect for
modeling true randomness because sequences are fundamentally unique
and cannot be bit-grouped under a binomial distribution. Therefore
pseudo-randomness is not applicable, not even as a necessary condition
for true randomness.
Now the question comes down to whether the distribution of unique
sequences is square integrable. If it is not, then the CLT does not
apply, and your beloved statistical tests are all invalid across the
board - even as necessary conditions.
Square integrability must be carried out to infinity. But that does
not seem to be a problem at first glance, since if the ensemble is
finite there is a cutoff where the distribution drops to zero for all
values greater than the cutoff. It would seem that this constant, flat
distribution is indeed square integrable because of that cutoff.
This is where my lack of formal training in number theory causes me to
have to stop. But I am deeply suspicious that the integral is not
defined even for a finite interval, because the TRNG must be capable
of generating ALL possible finite sequences, and this number grows in
an unbounded manner. Because the distribution is flat, it never tails
off and the integral becomes unbounded as the number of sequences gets
larger and larger. In that sense, the distribution is not square
integrable, the CLT does not apply, and standard statistics has no
meaning in terms of tests for significance.
I have given you math experts something to contemplate - so have at
it. But I trust you at least see the significance of the fact that in
crypto, each sequence is unique and cannot be combined into bit-groups
which are distributed binomially.
If I have made that point successfully, then I am satisfied for
today.
Bob Knauer
"The brave men who died in Vietnam, more than 100% of which were
black, were the ultimate sacrifice."
- Marion Barry, Mayor of Washington, DC
------------------------------
From: [EMAIL PROTECTED] (David P Jablon)
Subject: Re: Extending a hash?
Date: Sun, 4 Apr 1999 20:26:08 GMT
In article <[EMAIL PROTECTED]>,
wtshaw <[EMAIL PROTECTED]> wrote:
>In article <[EMAIL PROTECTED]>, Peter Gunn
><[EMAIL PROTECTED]> wrote:
>
>> 2) Are there any general purpose algorithms for 'extending' a hash
>> function that can be used with predictable results??
>
> [...] In short, there ain't no free lunch;
Wait, don't go away hungry. That free lunch might just be available
if you're using a password to negotiate a network session
key. There are key amplifier methods that negotiate a large
key based on a small one, between two parties.
>> Ive got Schneider's doc on low entropy keys and key stretching... what
>> else can I read??
See papers on SPEKE and related methods for
password-authenticated key exchange at:
<http://world.std.com/~dpj/links.html>
-- dpj
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
