Cryptography-Digest Digest #638, Volume #9 Wed, 2 Jun 99 11:13:10 EDT
Contents:
Re: Generating Random Numbers (Bo D�mstedt)
Re: Viability of encrypted flash cards? (Tommy the Terrorist)
Re: PGP Key security? (Tom McCune)
Re: Question about Cryptography/Encryption... (Bo D�mstedt)
Re: Simple crypto question (Russell Harper)
Re: The BRUCE SCHNEIER Tirade (David Hamilton)
Re: 576-bit blowfish?! ("Matthew Bennett")
Re: bareface ratio (I R A Aggie)
"On cryptosystems untrustworthiness" paper (Pavel Semjanov)
Re: Oriental Language Based Enryption (Patrick Juola)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (Bo D�mstedt)
Subject: Re: Generating Random Numbers
Reply-To: [EMAIL PROTECTED]
Date: Wed, 02 Jun 1999 12:03:16 GMT
"Brian Ross" <[EMAIL PROTECTED]> wrote:
>Hi,
>
>I was wondering how to generate random numbers which will be used for
>encryption keys. My main concern is how to generate a random seed which is
>random enough to ensure that the generated bits are indeed random.
>
>Brian
You could use the SG100 Security Generator
http://www.protego.se/sg100_en.htm
We deliver a lot of generators, to all countries in the world,
for lotteries, cipher applications, and statistical simulations.
Bo D�mstedt
Chief Cryptographer
Protego Information AB
------------------------------
From: Tommy the Terrorist <[EMAIL PROTECTED]>
Crossposted-To: alt.security,talk.politics.crypto
Subject: Re: Viability of encrypted flash cards?
Date: 2 Jun 1999 10:28:11 GMT
In article <[EMAIL PROTECTED]> fungus,
[EMAIL PROTECTED] writes:
>Better to say "I never knew the passphrase, it was randomly generated
>by the computer and changed once per week. I just copied it from the
>piece of paper when I needed to access the data, I never memorized
>the 16 random letters - too difficult for me, I think it began with
>a G though. The paper??? Oh, I ate the paper when I was arrested...."
Yeah, right. And then they'd come up with one of their arguments
verging on the mystical concerning the "crime" of 'destroying evidence'
and how that applies to things you should have known might have been
subject to some future subpoena, and so on.
If the paper really gave a damn about privacy (and since they're just
another corporation, I doubt they do) then they'd have a policy to
destroy such unused archival negatives, or at least to leave them in
the unpredictable hands of individual photographers, in such a regular
fashion as to ensure that it's done before any legal action. Either
that or just challenge the bastards head to head - someday these
courts have to be educated by someone concerning how far they
can order people around and expect 100% obedience, the problem is
finding someone with the balls to fight back. (And I'm not saying it's
an easy thing)
------------------------------
From: [EMAIL PROTECTED] (Tom McCune)
Subject: Re: PGP Key security?
Date: Wed, 02 Jun 1999 11:27:44 GMT
=====BEGIN PGP SIGNED MESSAGE=====
In article <[EMAIL PROTECTED]>,
[EMAIL PROTECTED] wrote:
>Your pass phrase is never saved to disk. It is run through the Hash
>function to produce a key which is then used to decrypt your secret
>key. The key is kept in memory for only a limited time before it too
>is erased.
Is this correct for both DOS PGP 2.6.2 and Windows PGP 6.0.2?
=====BEGIN PGP SIGNATURE=====
Version: PGP Personal Privacy 6.0.2
Comment: Tom McCune's PGP Page: http://www.borg.com/~tmccune/PGP.htm
iQCVAwUBN1UVLcMxrQ5/VTwtAQHl2wP/V0POxW6X5+9QsAbqa05RhUVI2lEVUfzs
Jdv59PL/j4QjRq9cIbZnPdrj6b6fdYw5h35pR9us7eiUHrkDmUngjvkkMO8olTtd
mRsfJFlyrH+xgQzh66aFREccyiUMT8P2wPL1qC+OsqClB9zZVImCM5xCQu92XuDZ
qp/nY7GtcNU=
=xyz3
=====END PGP SIGNATURE=====
------------------------------
From: [EMAIL PROTECTED] (Bo D�mstedt)
Subject: Re: Question about Cryptography/Encryption...
Reply-To: [EMAIL PROTECTED]
Date: Wed, 02 Jun 1999 12:24:23 GMT
http://www.cranfield.ac.uk/ccc/bpark/
http://www.jya.com/nsa-sun.htm
http://members.aol.com/nbrass/enigma.htm
http://www.maritime.org/ecm2.shtml
http://www.counterpane.com/biblio/
http://www.interhack.net/people/cmcurtin/snake-oil-faq.html
http://www.rsa.com/index.html
http://www.sics.se/nnrc/nyadatsit.html
http://www.tis.com/docs/research/crypto/crypt_surv_forpage.html
With my best regards,
Bo D�mstedt
Chief Cryptographer
Protego Information AB
Malmoe,Sweden
http://www.protego.se
------------------------------
From: Russell Harper <[EMAIL PROTECTED]>
Subject: Re: Simple crypto question
Date: Wed, 02 Jun 1999 12:52:12 GMT
Does your application connect to the internet, or is it expected to be on
computers that have internet access? If so, your problems are solved (or at
least your level of control is much better)! /Russell
SBS wrote:
> I am wondering how I can figure out the following problem. I need to set up
> a licensing scheme for software we sell to avoid uncontrolled spread of the
> software.
>
> Setting a data structure holding the licensing information is not very
> tough, hoewever how to I store that somewhere one the machine since I do not
> want to use dongle like security.
...
------------------------------
From: [EMAIL PROTECTED] (David Hamilton)
Crossposted-To: talk.politics.crypto,alt.privacy
Subject: Re: The BRUCE SCHNEIER Tirade
Date: Wed, 02 Jun 1999 13:14:09 GMT
=====BEGIN PGP SIGNED MESSAGE=====
[EMAIL PROTECTED] (SCOTT19U.ZIP_GUY) wrote:
(snip)
> Hamilton is the only one I know of that keeps tracks of posts
Wrong. DejaNews keeps track of posts.
> maybe he
> could
>help
I hope to help others by pointing out the extremely high odds against your
software being as secure as, eg, PGP. But, in reality, I suppose it's you
that makes this obvious by your postings.
> but I doubt if he would he seems to act as if he has a bug up his ass.
As opposed to the bugs in your software? There are a number of industry
standard measurements relating to bugs in software. Can you give any of these
for your software? ... Or perhaps, like everything else, you haven't
documented these things.
David Hamilton. Only I give the right to read what I write and PGP allows me
to make that choice. Use PGP now.
I have revoked 2048 bit RSA key ID 0x40F703B9. Please do not use. Do use:-
2048bit rsa ID=0xFA412179 Fp=08DE A9CB D8D8 B282 FA14 58F6 69CE D32D
4096bit dh ID=0xA07AEA5E Fp=28BA 9E4C CA47 09C3 7B8A CE14 36F3 3560 A07A EA5E
Both keys dated 1998/04/08 with sole UserID=<[EMAIL PROTECTED]>
=====BEGIN PGP SIGNATURE=====
Version: PGPfreeware 5.5.3i for non-commercial use <http://www.pgpi.com>
Comment: Signed with 2048 bit RSA key
iQEVAwUBN1Unk8o1RmX6QSF5AQGuIQf9FqHupCSIkkNpdFiQYGxeGInmX2nBDOSs
KNdmLU/Ry/Vm2OJQj7+/D87WHOf9hH5ZZEN1GjEKUrLxeH+Bdy2AZQwXc27xG1en
Ba0+5rnjsQUMfCO1MXkAy/Nq5dv5IdFB+cRyuZq12ayfZwarMF04WDaPrnmTVDA9
2hIEz0RKNxmZnb9r9tXDTicJam2PrkoP+lyHc3EbtedL9CPXWnbyje3FC4XWt1q5
cIiCuWhD+3ZYM4Jx2cb2FefOU4zSyqIj7q/m4HOkYY+T22eQZpN1R3IZVrbt7Hbs
fik8F3eKt6LCReHX1c5z988MNndvYkPTYV8PZrQmX+oKnUS1HCRX+A==
=Amab
=====END PGP SIGNATURE=====
------------------------------
From: "Matthew Bennett" <[EMAIL PROTECTED]>
Subject: Re: 576-bit blowfish?!
Date: Wed, 2 Jun 1999 14:23:02 +0100
Thanks for your replies. Due to some conflicting advice, I looked through
the Blowfish paper myself (from www.counterpane.com/blowfish.html ) as
suggested by John Myre. Like he said, it would appear that though up to
72-bytes do indeed modify the cipher-text, only the first 56 of these effect
every subkey:
"The 448 limit on the key size ensures that
the every bit of every subkey depends on every bit of the key.
(Note that every bit of P15, P16, P17, and P18 does not affect every
bit of the ciphertext, and that any S-box entry only has a .06
probability of affecting any single ciphertext block.)"
So it's possible using more than 56-bytes may be considered a security risk.
Of course, the final word could always come from the author himself :)
Thanks again for your help,
/\/\/\//
------------------------------
From: [EMAIL PROTECTED] (I R A Aggie)
Crossposted-To: comp.lang.perl.misc
Subject: Re: bareface ratio
Date: 2 Jun 1999 13:48:49 GMT
Reply-To: [EMAIL PROTECTED]
On Tue, 01 Jun 1999 16:05:39 -0400, Greg Bartels <[EMAIL PROTECTED]>, in
<[EMAIL PROTECTED]> wrote:
+ so, if you have a question, and no one
+ is responding, you can still get the
+ answer, all you have to do is make something
+ up first (bareface it), and the
+ corrections will flood in.
There are better solutions. Time for a repost...
James
===========begin repost==========somethings are timeless...
Date: 09 Nov 1995 02:57:30 GMT
From: [EMAIL PROTECTED] (Mark-Jason Dominus)
Subject: Re: system() question
There are a lot of reasons, many of which get repeated over and
over again, many of which don't. Some of the reasons you hear a lot
are: Questions are incoherently phrased. Questions have the form `my
code doesn't work' and don't include the code. Questions include the
code, and it's 200 lines long, and comp.lang.perl is not a debugging
service. Nobody knows the answer to the question. The question is so
badly punctuated that nobody can bear to read it. Questions aer
written by a non-native speaker of English and the native speakers who
are trying to understand it can't. (That's a shame, but it does
happen. I often wish that these people would post in their native
languages. I'd love to see more discussion in languages other than
English. Some Dutch guy tried posting all his comp.lang.c articles in
Dutch a few years ago, and all the Americans flamed him. How
humiliating for me!)
Apart from these oft-mentioned reasons are many others that are
not so often discussed, because anyone who tries to bring them up gets
flamed. But it's the truth: I know the reason I don't answer more
questions is because so many of them questions are so damn stupid.
They're stupid in a lot of different ways, but they're still stupid.
I don't want to suggest that that's why your questions go unanswered.
I don't know what you're asking. No doubt the reason your questions
go unanswered is because they're so deep and interesting that nobody
really knows the answer.
The most common stupid question is the one from someone who has
some high-level problem that they need solved. They have an idea that
they'd like to do it in perl, and they don't really know perl. So
instead of learning perl, they post to comp.lang.perl.misc.
Now don't get me wrong. I don't have any problems answering the
questions of someone who's trying to learn perl. I love THOSE
qusetions. But these people don't seem to be asking useful questions
for that.
Today, for example, I saw a question from a guy who wants to get a
list of hostnames out of nslookup. `How do I do that?' he says. And
it's hard to know what to make of that. What does he mean? Does he
not know how to open a pipe? Is his `open' command failing? What's
going on here? I can't give a useful answer without understanding the
problem. Having your `open' fail is a problem. Wanting to list
hostnames is not a problem; it's a desire.
Here are some similar questions that would have made more sense to me:
1. ``I'm a lazy asshole and I can't be bothered to learn to
program myself, but I know if I post here you'll give me
something for free.''
(OK, fair enough. At least I can send him a rate card.)
2. ``I'm trying to use `open' to talk to nslookup, but...
...here's my code; what's wrong?''
(Good question.)
3. ``I know perl has a `system' command for running programs,
but I can't see how to get my commands into nslookup
once I have run it.''
(Good question.)
4. ``I'm trying to use `getprotobynumber' to talk to nslookup...''
(Good question.)
See, I'm not just biting people's heads off, here. #4 is a good
question, because it gives me something to work with. OK, he has a
very weird idea about interprocess communication, but that's
ignorance, and that's what we're here to correct. He doesn't know
about `open'; I can refer him to the manual.
Here's another example: Some guy wants to assemble a list of email
addresses . ``How do I do that?'' he wants to know. Well, duh. Get a
big pad of paper and read news for a couple days and write down all
the addresses you see. Problem solved. What's it doing in
comp.lang.perl?
Oh, you wanted to do it in perl. Well, I guess I'd open a socket
to the NNTP server and send it some XHDR commands for the `From'
lines. But that's not Perl; you could do that in any language. I
could do it in Bourne Shell for you if I'm allowed to use a little
external thingie to handle the socket parts for me. What's it doing
in comp.lang.perl?
Oh, you wanted us to write the program for you? Wait, let me send
you my rate card.
Someone posted yesterday asking how to get the data from a file
where the start and end of the data is marked by keywords. Same thing
going on here. ``Well, here's how you solve your problem: First you
go take an introductory class in programming and learn to write
programs in some language. Then you go to the bookstore and buy this
book by Wall and Schwartz, it's really good. Read the book carefully
and try out the examples. Then if you still have general questions
like `How do I do this' instead of `I thought that this code would do
X but instead it does Y' you hire a professional to write your program
for you. Or you could just skip right to step 3. Want my rate
card?''
The worst stupid questions are the ones that come from people who
have no business asking them. The most perfect example of this that I
could have imagined was in comp.unix.questions a couple of years ago.
Some guy came and asked how you could tell if a file is a hard link.
My jaw flapped open and it's stayed open since then. I couldn't have
been any more stumped if he'd asked why Bodhidharma came from the
West. What do you say to this guy? Do you tell him the truth, that
all files are hard links, that even symbolic links are hard links?
He's not going to understand you; you might as well keep your mouth
shut. Do you tell him the truth, that the answer won't do him any
good because he doesn't know what a hard link is, so why did he bother
asking in the first place? No, that'll just make him mad. I followed
that message for the next couple weeks, and nobody said anything.
What could you say? The guy had no business asking the question and
no use for the answer. Maybe the right answer would have been to cut
off his finger or something. I dunno.
Some questions get ignored because they're boring. Someone asked
today how to compare two variables (I assumme he means the contents of
those variables) to see if they're exactly the same. You've gotta be
in an awfully good mood to take the time to answer that. Maybe
someone will. Maybe I will.
If I answer that one today, maybe he'll be back tomorrow asking
how to check to see if two variables contain different values. Maybe
I won't. What I find incredible is that if you tell these people to
go read the manual and come back in two weeks, you sometimes get
jumped on for not being helpful to beginners. Bah. If everyone told
these people to go read the manual, they'd eventually figure out that
that's what you have to do ,and then I wouldn't have to spend so much
of my life dealing with incompetent programmers.
Some questions are logically nonsensical because the querent
thinks they know more than they do. A lot of these have the form
``How do I use X to accomplish Y?'' There's nothing wrong with this,
except that sometimes X is a chocolate-covered banana and Y is the
integration of European currency systems. I always get stuck on
these, probably because I can't get rid of the idea that the person
really has a good reason for wanting to use X. I know a half-dozen
easy simple ways to accomplish Y, but I can't imagine what X has to do
with it. This is a problem for me in my day job, too. Clients are
always saying to me ``We want to use product X to do multimedia
development on the world-wide web,'' and all I can think is ``Well,
gee, what would you want to go and do that for?'' Sometimes it turns
out that they want to do it because they want to impress the
manufacturers of X, and I don't work on those jobs.
The flip side of this is a questions like ``I want to accomplish
X, but I don't want to use Y. What can I use instead?'' Which,
again, is sometimes reasonable, and then sometimes X is closing a
filehandle and Y is the `close' function.
The questions I like the best are the ones that go like this:
``I want to accomplish X.
I thought that the following code fragment would do it:
...
But instead it does Y.
Why is that?''
This one is also pretty good:
``I want to accomplish X.
I thought I might be able to use facility Y.
But Y doesn't seem like it's quite right,
because of Z.
What should I use instead of Y, or how can I overcome Z?''
When I ignore these, it's usually because I don't know the answer.
There were an awful lot of them today. It makes me very happy.
There you go; a 160-line dissertation on why questions go unanswered.
Now don't let me hear you saying nobody ever answers your questions.
------------------------------
From: Pavel Semjanov <[EMAIL PROTECTED]>
Subject: "On cryptosystems untrustworthiness" paper
Date: Wed, 02 Jun 1999 17:16:14 +0400
Hello!
Maybe my paper will be interested to someone...
Abstract:
The reasons of cryptosystems untrustworthiness can be divided into 4
main groups: application of weak algorithms, cryptalgorithms wrong
implementation or application and human factor. There is clear parallel
between these reasons and computer system security violation ones.
Because of pointed reasons there were and still there are security
problems in all kinds of software, where cryptalgorithms are used, be it
operating systems; cryptographic protocols; clients and servers
supporting them; office programs; user encryption utilities or popular
archivers.
To proper implement your own cryptosystem you should not only learn
somebody's mistakes and understand the reasons of their occurrence, but
perhaps use sophisticated protection programming approaches and special
design tools.
http://www.ssl.stu.neva.ru/psw/publications/crypto_eng.html
--
SY / C4acT/\uBo Pavel Semjanov
_ _ _ http://www.ssl.stu.neva.ru/psw/
| | |-| |_|_| |-| 2:5030/145.17@fidonet
------------------------------
From: [EMAIL PROTECTED] (Patrick Juola)
Subject: Re: Oriental Language Based Enryption
Date: 2 Jun 1999 09:33:03 -0400
In article <[EMAIL PROTECTED]>,
Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
>Patrick Juola wrote:
>> You're not taking into account the translation process. The
>> additional explicitness I cite isn't just a theoretical observation,
>> but a practical one by made by linguists in the field -- and you
>> can't blithely reverse the direction of the translation arrow.
>
>We are considering (everyday) normal messages, not literal works, for
>crypto purposes. So if the translation is good, one shouldn't be able
>tell which is the original and which is the translation. Lots of
>technical documents in multiple languages are excellent examples
>of equivalent translations.
>
>I think that even the concept of being an 'original' is questionable.
>If I know two foreign languages to about the same extent and write
>a business letter first in one language and after finishing it write
>a version in the other language, do you also think that there
>is some intrinsic difference between the two? (Here I myself am
>the translator.) I suppose that you assume that a translation must
>be poorer.
I assume nothing. I merely report the observations of the field
linguists who study this stuff. If you really want to argue with
empirical data, you're welcome to. But do it alone, please. I have
work to do.
>> One of the sources of this additional explicitness is the necessity
>> of setting the (target) text in a new cultural framework. There's
>> a good example from the work of Baker (1997?) -- the sentence "The
>> example of Truman was always on my mind," when translated into
>> Arabic, turned into a complete paragraph that more or less explained
>> to Arabic-speaking readers just who the hell Truman was. In general,
>> any time you're doing any sort of writing, you are implicitly making
>> expectations about the background of the reader -- and the more the
>> (actual) readers differ from your assumed background, the more work
>> the translator will need to put in to bring people up to speed.
>
>You example is not appropriate in the current context. We are
>considering the case where a message X is translated to Y, encrypted
>then decrypted to Y and then translated back to X'.
Who does the translation? You're more or less making the assumption
that the translator makes no changes at all to the phrasing or
informativeness. In many cases this isn't even *possible*; there's
no word in Japanese for 'brother', for instance. Older brother, yes.
Younger brother, yes. But there's no word for 'brother of unspecified
age.' Similar examples abound of lexical holes, as well as various
syntactic holes -- it's very difficult to write a sentence without an
(explicit) agent in English, very easy in Italian, which leads to lots
of overspecification of agency in the translation process. And so forth.
You also have to distinguish between the case where the original message
is written in one language and *translated*, probably by a second person,
into the second language and the case where you simply write in the 'target'
language to begin with. Although I'm delighted to hear that you're equally
fluent in several languages, I submit that *for this reason* you're not a
good person to look at the informativeness question when you're translating
your own work -- you're not translating, but rewriting.
-kitten
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
