Cryptography-Digest Digest #577, Volume #9 Fri, 21 May 99 23:13:03 EDT
Contents:
Re: HushMail -- Free Secure Email (Terry Ritter)
Re: Reasons for controlling encryption (Mike McCarty)
Re: Reasons for controlling encryption (Mike McCarty)
Re: RC4 based hash ([EMAIL PROTECTED])
Re: Biprime Cryptography, Part II (kurt wismer)
Re: pentium 3 (Steve Rush)
Re: PGP Implementation of DH/DSS vs. RSA. (DJohn37050)
Re: Biprime Cryptography, Part II (David A Molnar)
Re: pentium 3 (Terry Ritter)
Re: PGP Implementation of DH/DSS vs. RSA. (DJohn37050)
Re: HushMail -- Free Secure Email (Chem-R-Us)
Re: Looking for ScramDisk/PGPDisk user experiences (Johnny Bravo)
Re: HushMail -- Free Secure Email (Terry Ritter)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (Terry Ritter)
Subject: Re: HushMail -- Free Secure Email
Date: Fri, 21 May 1999 23:33:49 GMT
On Fri, 21 May 1999 22:23:15 GMT, in
<[EMAIL PROTECTED]>, in sci.crypt
[EMAIL PROTECTED] (John Savard) wrote:
>[EMAIL PROTECTED] (Terry Ritter) wrote, in part:
>
>>Most people on sci.crypt should probably check out the new free
>>encrypted email web site:
>
>> http://www.hushmail.com/
>
>>Encryption is end-to-end and occurs locally by downloading a public
>>key Java applet. Source is available. The company is outside the US.
>
>Recently, I tried the HotJava browser, and found it quite slow. Since
>public-key encryption is computationally-intensive, I'm a bit worried.
There is a slight delay. It seems fast enough to me. Exactly what
are you worried about?
We can download their source code. I assume it will get looked at.
But even if there are problems here, this idea is a way to change the
reality of crypto use. In a year we could have half the net going
through these guys, or their clones, and then be dealing with
commercial standards problems as opposed to governmental rules.
>Also, the way they say to just create an account, choose a user name
>and "Jiggle your mouse to create a random set of keys" ... I hope I
>don't do that *on their web site*, but on my computer later. Doubtless
>I'm misunderstanding the description.
I assume the screen we see is local. It is downloaded like any other
HTML and applet. That sort of interaction *should* be local, even if
we are still "on line." They would need unknowable randomness to set
up keys; the mouse seems likely to be far better than the keyboard.
>Yes, an encryption program more convenient to use than PGP will
>increase the popularity of encryption. Since they're using their own
>"patent-pending technology", and are asking users to register, I
>expect this is going to be tied into a later commercial offering of
>some type.
All I know is what I read. They claim to want to sell the technology
to "the big boys." Selling a popular web site is hardly new. That
doesn't necessarily mean it will become non-free. The advertising is
what makes if "free." But if "the technology" they mean is the web
part of this (the crypto being well known), it is hard to imagine any
US company being able to buy it.
---
Terry Ritter [EMAIL PROTECTED] http://www.io.com/~ritter/
Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Free Encrypted Email www.hushmail.com [EMAIL PROTECTED]
------------------------------
From: [EMAIL PROTECTED] (Mike McCarty)
Subject: Re: Reasons for controlling encryption
Date: 21 May 1999 23:26:25 GMT
In article <[EMAIL PROTECTED]>,
Douglas A. Gwyn <[EMAIL PROTECTED]> wrote:
)Mike McCarty wrote:
)> Of course there isn't just *one* secret involved in making a
)> successful nuclear weapon. Nor in making a successful cryptographic
)> system. But the point was the arrogance involved in thinking that
)> information of that sort can be suppressed.
)
)It not only *can* be suppressed, it often *has* been suppressed.
)
)> ... But just knowledge in general cannot be suppressed.
)
)Oh, yes, it can, and in cases of national security it must be.
No, it cannot. Dissemination of information can be suppressed, but
information of that nature cannot, because it can be independently
discovered.
)> ... This was used as rationale for the siezure and mortgage of all
)> properties in the US to the Federal Reserve Bank ...
)
)I'm no fan of the Federal Reserve system, but again, you're not
)helping your cause by such wild statements.
This statement is not wild. In fact, you can find almost those words in
the Congressional Record. I forget which congressman said (not quite a
quote, but quite close, and I *can* get the exact quote if you want it)
If we pass this bill, which God forbid, it will mean the end of
the Constitution.
I suggest you educate yourself rather than make rash accusations.
Mike
--
----
char *p="char *p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
I don't speak for Alcatel <- They make me say that.
------------------------------
From: [EMAIL PROTECTED] (Mike McCarty)
Subject: Re: Reasons for controlling encryption
Date: 21 May 1999 23:22:22 GMT
In article <[EMAIL PROTECTED]>,
Mike Fredenburg <[EMAIL PROTECTED]> wrote:
[snip]
)Unfortunately, many people who go into government like power and they do
)not like technology that takes power away from them. Encryption is
)definitely such a technology.
[snip]
I'd say that the other way 'round. Often, people who like power wind up
in government.
I'm much more afraid of what criminals in government can do than what
common criminals outside of government can do.
Let's suppose that everyone having crypto allows some people to commit
some dastardly deeds in secret, and we can't find them. Well, that
means that some private criminals are getting away with some bad stuff.
But if we strip the common man of the ability to maintain his privacy
in order to catch those criminals, then we have set up the machinery
for some dishonorable people to come along later (the ones we have
running the gov't now are all honorable, of course, and they want this
power only for honorable reasons, but some day someone might get in
power who was dishonorable). Then instead of the Mafia, we have Hitler.
I'll take the Mafia over Hitler any day.
And if you didn't notice, my tongue was firmly in my left cheek when I
made the parenthetical statement above.
--
----
char *p="char *p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
I don't speak for Alcatel <- They make me say that.
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: RC4 based hash
Date: Fri, 21 May 1999 22:59:18 GMT
I guess it depends on the key uniquness of RC4. Are there any formal
results of this type of hash?
Tom
--
PGP public keys. SPARE key is for daily work, WORK key is for
published work. The spare is at
'http://members.tripod.com/~tomstdenis/key_s.pgp'. Work key is at
'http://members.tripod.com/~tomstdenis/key.pgp'. Try SPARE first!
--== Sent via Deja.com http://www.deja.com/ ==--
---Share what you know. Learn what you don't.---
------------------------------
From: kurt wismer <[EMAIL PROTECTED]>
Subject: Re: Biprime Cryptography, Part II
Date: Fri, 21 May 1999 21:58:42 GMT
wtshaw wrote:
>
> In article <[EMAIL PROTECTED]>, kurt wismer
> <[EMAIL PROTECTED]> wrote:
>
> > Nathan Kennedy wrote:
> > >
> > > In fact, don't change the name "public key cryptography" at all.
> > > I do not believe you could change that to anything more helpful.
> >
> > i don't know... asymetric key cryptography may be a little more
> > descriptive...
> >
> > at least to those who know what symetric and asymetric mean in general..
> >
> These are poor classification choices since symmetry can refer to many
> different qualities of algorithms.
maybe you and i use asymmetric differently... i thought it was
understood that an asymmetric algorithm was one which you could not
decrypt a message with the same key used to encrypt the message...
> Given the choices, "Conventional
> Encryption," is a better term for all other than Public Key algorithms,
> and has been used by some authors.
i would agree that conventional encryption is a good term... but for
public key algorithms, "public key" doesn't really convey the fact that
there are at least 2 keys and that messages encrypted with one can only
be decrypted with the other... the concept of asymmetry says more about
this than the term "public key" does...
another possibility might be to describe them as 2-key systems, though
that would actually be inventing a new term rather than using ones like
symmetric and asymmetric algorithms which already enjoy some use in the
community... (don't shoot the messenger)
--
"close your eyes and bow your head
i need a little sympathy
cause fear is strong and love's for
everyone who isn't me"
------------------------------
From: [EMAIL PROTECTED] (Steve Rush)
Subject: Re: pentium 3
Date: 21 May 1999 22:54:32 GMT
>I've read that the pentioum III has a hardware random
>number generator in it. Is it really random or
>pseudo random? if really random, how did they do that?
>has anyone run some randomness tests on it?
I don't know of any independent test results. At the scale of sizes used in
the construction of these chips, quantum effects become significant.. There is,
then, a source of real randomness. The tricky part is reading the random bits
without adding a bias. A CPU is, after all, driven by a periodic clock signal,
and has lots of regular structures to resonate.
And that doesn't even consider the possibility of Intel being bribed (or
threatened) by Big Brother to build a subtly flawed RNG.
**********************************************************************
If it's spam, it's a scam. Don't do business with Net abusers.
------------------------------
From: [EMAIL PROTECTED] (DJohn37050)
Subject: Re: PGP Implementation of DH/DSS vs. RSA.
Date: 22 May 1999 00:19:56 GMT
Also, many people use a low value for the RSA public exponent to improve
performance. Dan Boneh has given convincing arguments that breaking low
exponent RSA may not be equivalent to factoring the modulus.
Don Johnson
------------------------------
From: David A Molnar <[EMAIL PROTECTED]>
Subject: Re: Biprime Cryptography, Part II
Date: 22 May 1999 00:25:05 GMT
John Savard <[EMAIL PROTECTED]> wrote:
>>Note that RSA would still work if you had a modulus that was of the form
>>p^k * q, p and q prime. In fact, you get a possible speedup that way
>>by using the Chinese Remainder Theorem to compute modular exponentiations
>>over each of the small p s and the q independently before combining 'em
>>together.
> If the p's are small, doesn't that make factoring the modulus very
> easy?
Sure seems like it. You would have to figure out just how small is safe.
This may also depend on the adversary's factoring algorithm -- the
elliptic curve algorithm, for instance, seems to have a running time
dependent on the size of the smallest factor of the number factored,
so that would make it particularly nice for p^k * q.
It may help to know just how much the trick speeds up RSA, so you
can have at least one bit of semi-hard data.
I can't find the paper right now, so a few screen calculations...
(with the understanding that if he was able to publish in
Crypto, then he probably found some k-kool trick that makes
this misleading. anyway)
If we take the cost of a modular exponentiation of an
arbitrary number mod n as O(ln^3 n) bit operations, then for the
case of a two-prime 1024 bit modulus, it seems that we would have
two modexps of 512^3 = 134217728 bit ops each . So the question
seems to be whether we can get underneath this (and we should
probably add in the cost of multiplying the two numbers
together - 512^2 or 262144 bit ops) while still being 'secure
enough.' Total : 268697600 ops
For p = 256 bits, q = 512, the exps mod p should be 16777216 each,
and the exp mod 512 is still 134217728 bit ops. Multiplying
should be 256^2 for each of the p, then 512^2 for the product and
the q, for a total of 327680 bit ops. Total : 168099840
This means that the p = 256, q = 512 is about 100597760 ops faster.
Expressed as a percentage of the 512,512 running time, this is about
37%. Not going to break any complexity-theoretic ground, but nice,
especially since all these estimates are high, I think.
So then the question is whether a 37% speed increase is worth
having a 256-bit smallest prime factor instead of a 512-bit
smallest factor of a 1024-bit modulus. This is where it seems
to get hairy.. :-(
i
In any case, I'll try to find the original paper and see if they
did anything substantially clever/differnt.
It also seems that the Crypto '99 paper is already available
at http://theory.stanford.edu/~dabo/abstracts/prq.html
The abstract claims a poly-time factoring for N = p^r q when
r is about log_2 of p. since log_2 256 is 7... oh dear.
-David Molnar
------------------------------
From: [EMAIL PROTECTED] (Terry Ritter)
Subject: Re: pentium 3
Date: Sat, 22 May 1999 00:18:09 GMT
On Fri, 21 May 1999 17:13:21 -0400, in <[EMAIL PROTECTED]>, in
sci.crypt Greg Bartels <[EMAIL PROTECTED]> wrote:
>I've read that the pentioum III has a hardware random
>number generator in it.
No, it is on "a support chip."
>Is it really random or
>pseudo random?
Supposedly really random.
>if really random, how did they do that?
We might assume that it is based on US Patent 5706218: Random number
generator, issued Jan. 6, 1998. If so, we have an amplified Johnson
noise voltage (thermal resistive noise) which controls a voltage
controlled oscillator (VCO). This slow jittery oscillator clocks
multiple latches. Each latch captures the instantaneous state of a
separate fast oscillator.
>has anyone run some randomness tests on it?
The question is whether we would accept those tests. I have several
problems with the patented design:
1. The explicit randomness is shared by multiple data bits. So we
must hope that the fast oscillators are not phase-locked or even
partially correlated in some way.
2. We also hope that the Johnson noise is sufficiently isolated so
that any jitter is due to quantum noise, as opposed to local switching
transients.
3. If we only have the digital outputs, it is not clear to me that we
can show that Johnson noise even has an effect. We would like to cool
or heat the chip and thus vary the randomness in some detectable way.
If we had access to the slow oscillator we might be able to measure
jitter with respect to temperature.
---
Terry Ritter [EMAIL PROTECTED] http://www.io.com/~ritter/
Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Free Encrypted Email www.hushmail.com [EMAIL PROTECTED]
------------------------------
From: [EMAIL PROTECTED] (DJohn37050)
Subject: Re: PGP Implementation of DH/DSS vs. RSA.
Date: 22 May 1999 00:16:15 GMT
DL is considered slightly stronger than RSA. For ANSI X9 purposes, the minimum
keysize for both is 1024 bits. For ECC it is 161 bits.
Don Johnson
------------------------------
From: Chem-R-Us <[EMAIL PROTECTED]>
Subject: Re: HushMail -- Free Secure Email
Date: Fri, 21 May 1999 18:43:49 -0700
Terry Ritter wrote:
>
> If this ends up being practical, it could obsolete PGP in many cases,
> and might change the practical situation for cryptography more than
> any court decision.
Hmm... Requires Java. OK, I can live with that.
Hmm... Requires Javascript. Not real excited about that. AT ALL...
Turning on Javascript just to send encrypted email to other hushmail
people is not my idea of simple and easy, and certainly not secure
(from an machine security view). Leaving my browser Javascript
enabled all the time is a definite security NO-NO!!
For the windoze weenies, it's just another false sense of security
product. For serious Unix people, it's just more crap.
Mixmaster remailers. Now there's some email security.
My $0.02
--
Chem-R-Us
------------------------------
From: [EMAIL PROTECTED] (Johnny Bravo)
Subject: Re: Looking for ScramDisk/PGPDisk user experiences
Date: Fri, 21 May 1999 22:12:49 GMT
On Wed, 19 May 1999 17:43:38 -0700, Sundial Services
<[EMAIL PROTECTED]> wrote:
>We are acquiring a laptop computer that will carry working-copies of
>source-code to our software products ... the crown jewels of our
>kingdom, obviously, and we need to be certain that this material will be
>safe from disclosure even if the computer itself takes someone else's
>flight.
>
>This sounds like an obvious application for ScramDisk or PGPDisk, which
>would allow us to secure the important materials on the drive so that
>they would be worthless to a thief.
>
>Therefore, we would like to gather real-world experiences with these
>products. Gotchas? War-stories? Things you "wish you didn't know now
>that you didn't know then?"
>
>(Please reply to newsgroup only. No vendors, please.)
If you are really worried that someone would try to steal one of
these laptops to get at the source code. You need to be aware that
the crypto is only as good as the passphrase that protect it.
I reccomend that someone who knows a little about the topic review
the passphrases chosen to protect the computers.
It would be best if each user chose his own passphrase, otherwise
there would be a temptation to write down a hard to remember phrase.
Names of family, dates of birth, and SSNs are bad places to draw
password material from.
You could have a master list of paswwords kept in a central location
on an ecrypted drive. This would allow someone who forgets the
passwords to recover them as needed. And would also allow your
business access to the drives if it should ever be needed.
If you use scramdisk (which let's you select the cipher you use for
encryption), make sure you review all the documentation, there are a
couple of ciphers included that are pretty weak but were included for
compatibility with older versions, Tea and DES. For commercial uses,
Triple DES would be a good choice for you.
Johnny Bravo
"Scramdisk is about as good as protection gets for Windows systems.
However, I consider Windows a security risk as it is, but that is
another topic."
------------------------------
From: [EMAIL PROTECTED] (Terry Ritter)
Subject: Re: HushMail -- Free Secure Email
Date: Sat, 22 May 1999 02:36:53 GMT
On Fri, 21 May 1999 18:43:49 -0700, in <[EMAIL PROTECTED]>,
in sci.crypt Chem-R-Us <[EMAIL PROTECTED]> wrote:
>Terry Ritter wrote:
>>
>> If this ends up being practical, it could obsolete PGP in many cases,
>> and might change the practical situation for cryptography more than
>> any court decision.
>
>Hmm... Requires Java. OK, I can live with that.
>
>Hmm... Requires Javascript. Not real excited about that. AT ALL...
>Turning on Javascript just to send encrypted email to other hushmail
>people is not my idea of simple and easy, and certainly not secure
>(from an machine security view). Leaving my browser Javascript
>enabled all the time is a definite security NO-NO!!
>
>For the windoze weenies, it's just another false sense of security
>product. For serious Unix people, it's just more crap.
>
>Mixmaster remailers. Now there's some email security.
>
>My $0.02
>
>--
>Chem-R-Us
HushMail requires JavaScript? Really?
OK, I tried it: I turned off JavaScript in my Netscape 4.5, closed
all copies, restarted the program, checked that JavaScript was off,
and went back to HushMail. Everything came up fine. I entered my
user ID, then my passphrase, then selected my test email and read it.
As far as I can see, everything works fine *without* JavaScript.
I then went back through these pages looking at source. Their main
page does have a JavaScript routine, which appears to be checking for
MSIE version, since the system will not work on early browsers. That
routine may not need to execute at all.
So we see that having JavaScript off is *not* a problem for *my* poor
little Win95 system. But I don't know, maybe it *is* a problem for
"serious Unix people" and their systems which are so much more capable
than mine.
---
Terry Ritter [EMAIL PROTECTED] http://www.io.com/~ritter/
Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Free Encrypted Email www.hushmail.com [EMAIL PROTECTED]
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
