Cryptography-Digest Digest #338, Volume #11 Wed, 15 Mar 00 10:13:01 EST
Contents:
Re: Universal Language (Richard Herring)
Re: new Echelon article ("Leo Sgouros")
Re: [Tabloid Humor] Greatest threat ever to computer security (Jeffrey Williams)
Re: Crypto Patents: Us, European and International. ("Trevor L. Jackson, III")
Re: Q: Voice encryption ("Trevor L. Jackson, III")
Re: Q: Coding of music notes ([EMAIL PROTECTED])
Re: why xor?(look out,newbie question! :) ("Trevor L. Jackson, III")
Costing encryption laws (_Andy_)
Re: Random permutations ("Trevor L. Jackson, III")
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (Richard Herring)
Subject: Re: Universal Language
Date: 15 Mar 2000 11:55:46 GMT
Reply-To: [EMAIL PROTECTED]
In article <8am56f$u$[EMAIL PROTECTED]>, Mike McCarty
([EMAIL PROTECTED]) wrote:
> In article <8alge4$g6d$[EMAIL PROTECTED]>,
> Richard Herring <[EMAIL PROTECTED]> wrote:
> )In article <[EMAIL PROTECTED]>, Mok-Kong Shen
>([EMAIL PROTECTED]) wrote:
> )> and Russian is even more complicated in my view.
> )
> )Arguable. Six cases, but only two aspects and two tenses.
> [snip]
> Err, seven cases. Though they are not fully represented.
Nominative, accusative, genitive, dative, instrumental, prepositional.
Which one did I miss?
--
Richard Herring | <[EMAIL PROTECTED]>
------------------------------
From: "Leo Sgouros" <[EMAIL PROTECTED]>
Crossposted-To:
alt.politics.org.cia,alt.politics.org.nsa,alt.journalism.print,alt.journalism.newspapers
Subject: Re: new Echelon article
Date: Wed, 15 Mar 2000 12:14:36 GMT
"Mok-Kong Shen" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> [EMAIL PROTECTED] wrote:
> >
>
> > This particular article is about James Woolsey, the former director of
> > central intelligence, telling foreign journalists that Echelon and
> > other eavesdropping facilities are used against European and Asian
> > industry solely to ferret out bribery, which may be practiced but
> > still is illegal in the U.S. Spoonful of sugar and he thinks you'll
> > swallow this load of crap. The crime is that, although the article
> > was unsigned, the reporter let Woolsey get by with this "excuse"
> > without confrontation with facts obvious to even the most casual of
> > observers.
>
> If there were a robot that is programmed to ferret out 'bribery'
> informations out of the whole stuffs collected and destroy all the
> rest, the scene would indeed have a different flavour. But there
> are humans and these at different levels of payroles. Even if
> the top-level ones were really all gentlemen, strictly performing
> according to laws and instructions, how is one going to control
> the conduct of a large number of the not-so-well-paid employees who
> have materials constantly and secretly passing through their hands
> that are worthy of hundreds of thousands of dollars?
>
> M. K. Shen
> ----------------------------
> http://home.t-online.de/home/mok-kong.shen
There really is no way to resolve this.We cannot put ourselves at the mercy
of robots to make all decisions.And it is unrealistic to micro-manage
society to the point where there is a wire in every phone and a camera in
every mirror.The end result is usually legislation to solve the instant
case, that inevitably leads to repression, because clamor rises to a certain
point and then society is conditioned to scream "something must be done",
and with the help of the willing media and a few control groups with special
interests, bad laws are enacted.A microcosm of the wheel of life, is it not?
Like any secret operation , the method and the capability is there, all you
need is the motive.Now, how do we become a society of people with honorable
motives?
Oops, here we are justifying what is honorable in the name of some greater
good. :-)
The tools are there in the secret world of intelligence, and the best we can
do is continue to press for transparency and oversight.
+/-
------------------------------
From: Jeffrey Williams <[EMAIL PROTECTED]>
Crossposted-To: alt.computer.security
Subject: Re: [Tabloid Humor] Greatest threat ever to computer security
Date: Wed, 15 Mar 2000 07:30:37 -0600
Actually, it is working. It's just slightly incorrect. The "1745.html"
is part of the link.
Jeff
Steven Alexander wrote:
> Does anyone have a copy of this. The link is no longer working.
>
> -steven
>
> [EMAIL PROTECTED] wrote in message <8akf58$kt$[EMAIL PROTECTED]>...
> >
> >
> >http://www.weeklyworldnews.com/stories/
> >1745.html
> >
> >
> >
> >I'm going down, all the way down
> >on the highway to Hell -AC/DC
> >
> >
> >
> >Sent via Deja.com http://www.deja.com/
> >Before you buy.
--
Jeff Williams
Software Design Engineer
DNA Enterprise, Inc
1240 E Campbell Rd, Richardson, TX, 75081
972 671 1972 x265
[EMAIL PROTECTED]
Did you know that there is enough sand in
north Africa to cover the entire Sahara?
------------------------------
Date: Wed, 15 Mar 2000 09:01:35 -0500
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: Crypto Patents: Us, European and International.
Eric Lee Green wrote:
> Terry Ritter wrote:
> > prevented others from obtaining a patent on that very same idea. In
> > fact, patents can be applied for even after someone else's publication
> > of that idea, given witnesses and/or patent notebook records.
>
> There once was a 1-year-max period between time of invention, and time of
> filing. Do you know if that still holds?
The procedure has been revised. It now offers an optional intermediate step that
establishes filing date precedence without requiring claims or even a detailed
description. There are now two kinds of application. A Preliminary Patent
Application (PPA) requires a minimal amount of information. It establishes the filing
date for any subsequent patents. The Regular Patent Application (RPA) is a full
description with detailed claims of coverage. A PPA is optional. If a PPA is filed
the filer has one year in which to follow up with an RPA or the precedence of the
original filing date is lost.
Unfiled inventions do not expire or become unpatentable. Date precedence may be lost
if the inventor fails to develop the invention and someone else files in the mean
time. But if the original inventor can show the original invention date and a
reasonable process of developing the invention toward patent application the gap
between invention and filing is not limited.
>
>
> As for witnesses and/or patent notebook records, it's amazing that we don't
> have more illegally obtained patents than we do, given how easy it is to forge
> records and/or find witnesses willing to perjure themselves for money...
How easy is that? Typically it is very hard to persuade innocent people to expose
themselves to the threat of a federal felony conviction. In most cases perjury is
heavily penalized.
>
>
> --
> Eric Lee Green [EMAIL PROTECTED]
> Software Engineer Visit our Web page:
> Enhanced Software Technologies, Inc. http://www.estinc.com/
> (602) 470-1115 voice (602) 470-1116 fax
------------------------------
Date: Wed, 15 Mar 2000 09:37:59 -0500
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: Q: Voice encryption
Mark Currie wrote:
> In article <[EMAIL PROTECTED]>, [EMAIL PROTECTED] says...
> >
> >John Savard wrote:
> >>
> >> Mok-Kong Shen <[EMAIL PROTECTED]> wrote, in part:
> >>
> >> >I like to know whether there are reasons against using both
> >> >techniques simultaneously.
> >>
> >> Usually, for digital voice encryption, a vocoder-like technique, such
> >> as CELP, is used to digitize the voice with very high compression.
> >> This prevents using analog scrambling as well.
> >>
> >> Since most analog scrambling techniques are very insecure, it would
> >> seem there is no point in combining them with digital techniques,
> >> considering the large cost in bandwidth.
> >
> >I don't yet understand why analog scrambling needs to increase
> >bandwidth. You add noises in the same audio frequency range, don't
> >you. True, it adds cost and is inferior to digital scrambling,
> >and the sound quality will be poorer (I guess probably as a result
> >of the fact that the energy of the proper signal getting through
> >is reduced due to the simultaneous transmission of noise?).
> >My point is that its use could supplement digital scrabling and that
> >could be perhaps justified depending on applications. Of course,
> >one applies analog scrambling first and the result is again
> >'voice'. Thus I don't see your point of analog scrambling causing
> >CELP impossible to be applied. By the way, could you please give
> >a literature pointer to CELP?
> >
> >It seems that one commonly employs a stream cipher for digital
> >scrambling. That's why I asked whether one could employ a block
> >cipher like DES. I mean whether this blocking could ever cause
> >any effect to the quality when one hears the result. Anyway, are
> >block ciphers in fact employed in practice in digital scrambling
> >or are they yet a theoretical possibility? Further, I am interested
> >to know which stream ciphers are used in the common types
> >of digital scrambling.
> >
> >Thanks.
> >
> >M. K. Shen
>
> One reason for using stream ciphers is that they can be made into
> self-syncronising ciphers that automatically correct themselves when errors
> occur on the line. Unlike data, voice has to be real-time, i.e. you can't waste
> time re-transmitting voice packets that have failed due to errors. On the
> question of which algorithm to use - most block ciphers can be turned into
> self-synchronising stream ciphers.
Actually you can do a surprising amount of traffic management with voice. There's a
company with some fundamental patents in this area -- type-based encoding and
compression -- named I-Link. The patents are fundamental to good voice-over-IP. The
type-based encoding lets you mix voice, fax, modem, etc. streams on the same wire
(fiber). It is about two orders of magnitude more effective (in engineering units)
than point-to-point telephony connections.
In business terms, $, the comparison with existing infrastructure is interesting. It
costs about 2.8 cents per minute for a long distance provider to support a pure voice
telephone call. That cost provides something of a floor to long distance rates.
Those rates will decline with technological advances but the fundamental technology is
over 100 years old, so we don't expect sudden decreases. With effective coding and
compression it costs only 0.02 cents per minute to support a voice call. Mostly this
is due to the fact that while voice is real-time at 1 sec resolution, it is no where
near real time at 1 ms resolution. So there's a lot of room for managing voice
traffic, and the opportunity to mix many voice streams over a single channel.
Given a packetized data stream, mixed or not, adding error and cipher protection costs
only a little processing power. There's no fundamental restriction that says voice
requires a self-synchronizing stream cipher.
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: Q: Coding of music notes
Date: Wed, 15 Mar 2000 14:34:57 GMT
martin2305 <[EMAIL PROTECTED]> wrote:
[...]
>>>Could someone give links on coding of music notes for computer
>>>processing? Are there any coding standards? Thanks.
>>MIDI is the nearly universal standard for this. A Web search
>>should turn up *plenty* of references.
> MIDI is fine for representing notes in terms of pitch, duration,
> dynamic etc. Unfortunately it's not much good in a composition
> program, where the need is to represent notes in terms of their
> position on the musical stave, with accidentals, articulation,
> phrasing etc. AFAIK there is no effective standard for this
> latter requirement; MIDI seems to be the only (and not very
> satisfactory) medium of exchange among different composition
> packages.
There's also SMDL - Standard Music Description Language, ISO/IEC DIS
10743:1995
SMDL is organized by Working Group 3 of ISO/IEC JTC1/SC34 (Information
Association). "The Standard Music Description Language (SMDL), an
application of the HyTime Hypermedia/Time-based document structuring
facilities, is described. The discussion covers the domains of
information that SMDL associates with any piece of music, the timing
of cantus events, pitch in cantus events, gamut-based pitches,
just-intoned pitches, user-defined functions for pitches, chords and
chord symbols, instrumental and vocal sounds, and non-western music."
[from Steven R. Newcomb]
However, this is off topic for sci.crypt. For more information on SMDL
you want comp.text.sgml or http://www.oasis-open.org/cover/.
--
Matthew Gauthier <[EMAIL PROTECTED]>
------------------------------
Date: Wed, 15 Mar 2000 09:53:56 -0500
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: why xor?(look out,newbie question! :)
John Savard wrote:
> On Mon, 6 Mar 2000 17:26:16 -0000, "Joseph Ashwood"
> <[EMAIL PROTECTED]> wrote, in part:
>
> >> I thought that were already the past. Which are the
> >typical
> >> manufacturers of the two different groups today?
>
> >x86 and everyone else. Actually that's not quite true, most
> >new processor designs support both directions, but the OS
> >chooses one or the other.
>
> While I'd like to support that point of view, I remember reading an
> article that painted the picture the other way: those wanting to put
> numbers in memory were called the "outlaws", and the article noted
> that they often worked their mischief in floating-point units.
>
> The Power PC chip and the forthcoming Itanium chip from Intel are
> examples of processors that support both directions.
>
> In the past, the order resembling how numbers are written in English
> and in other European languages, the most significant part coming
> earlier in the low address, was used by the IBM 360 and later by the
> Motorola 68000. (In this order, the hex number 12345678 would be
> stored as the bytes 12 34 56 78.)
>
> The opposite order - suitable to Arabic, since it is read from right
> to left, yet the least significant digit is still on the right - was
> used by the PDP-11, the MOS Technology 6502, and the Intel 8080 and
> 8086 to Pentium. Also, the National Semiconductor 16032. (In this
> order, the hex number 12345678 would be stored as 78 56 34 12.)
>
> Some older minicomputers used the order 56 78 12 34, because they
> stored numbers 16 bits at a time, and stored a 16-bit number in
> conventional order, but then stored 32-bit numbers so that the last
> half was first for faster adding. (The Honeywell 316, a computer used
> for Internet communication purposes in the earliest days, was one of
> these, IIRC.)
>
> To me, the IBM 360 order is simply easier to understand. But others,
> seeing IBM as a menacing monolith, seeing the PDP-11 as the computer
> of liberation, UNIX, and C, and finding it simpler that bit 0 of a
> word always represents the value of 2^0, champion the other order,
> and, except at Motorola and Texas Instruments, they carried the day in
> most of the world of microcomputer chips.
I think you are referring to a conflict other than byte ordering. The numbering
system for bits within a word can run from LSB to MSB in two flavors, or in the other
direction. The IBM bit numbering system had bit 1 as the MSB and bit 32 as the LSB.
The typical minicomputer numbered the bits as you described, according to the
respective power of two. There's also a bit numbering that runs from 1 at the LSB to
32 at the MSB, a seriously ugly mechanism in that it is the worst of both worlds.
Bit numbers are more important in documentation than in source code. Some of the most
thorough documentation uses _both_ of the 1-32 numbering systems in the illustrations,
just so the reader can count in either direction. AFAIK this is the only place that
the little-endian 1-32 numbering has any utility at all.
------------------------------
From: [EMAIL PROTECTED] (_Andy_)
Subject: Costing encryption laws
Reply-To: [EMAIL PROTECTED]
Date: Wed, 15 Mar 2000 14:59:29 GMT
(Begin lunchtime brain-dump)
The US and UK governments insist on being able to access every
company's data. Companies who regularly deal with information that is
sensitive in nature - where information is deliberately withheld from
the security services or government - would have to move the
information to another state. For example, those who investigate the
government (e.g. media) would not only have to be able to divulge all
their information by law, but the security services would already have
their data through the various mechanisms in place! The only way to
stop this from happening would be to move the information to another
country. Or move the media company.
In the UK and the USA, various legal documents and acts are
being proposed (and passed in some cases) that concern cyptography.
Most faults and issues that are involved in these drafts have been
discussed at length. But one issue does not seem to have been
addressed:
What is the cost of *not* adhering to the encryption laws?
With "unlimited fines" being whispered, there would be a point
for a company when it would not be worth while adhering to the law.
The costs of relocation would be less than the fine, or sum of fines.
This may sound far fetched, but when you consider how many companies
operate their systems at various points on the globe, then perhaps it
isn't so far fetched after all.
We now live in a state where we no longer have a secure method
of communication. Therefore, companies and private individuals who
don't trust the government or police officers (who get paid less than
�30k p.a. and are prone to taking a few back-handers) need to examine
their security policy themselves. More to the point, they need to put
a pound sign, as opposed to a Union Jack, on the bottom line. The cost
of 3rd parties leaking information to others, or rivals, could be just
as bad as an unlimited fine.
The varying degrees of paranoia of both those who support
encryption and it's associated laws and those who don't can be
ignored. What needs to be assertained is the actual cold, hard cash
implications of these laws on a company - the private individual may
as well jump on the bandwagon too.
So, imagine a world where all sensitive information is held in
one un-governed state, where there are no draconian laws allowing
access to it besides those who own it. Now imagine the relative
positions of other states such as the US and the UK. It is generally
agreed that those with the information have the power. With the loss
of access to information, well.. you might as well announce that
aliens have visited Earth!
So, has any company or individual worked out a formula for
working out when companies should move to where laws allow them the
security they require?
No, I don't think so. You are allowed to advance cryptography,
but only within the confines of the laws - multitudes of them in fact!
So, this leads my opinion that companies have the following ABCD
options:
1) Abide by the laws and take on the risk.
2) Break the laws and take on the fine.
3) Change the law and take on the state.
4) Decamp the company and take on the cost.
------------------------------
Date: Wed, 15 Mar 2000 10:13:23 -0500
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: Random permutations
"Bo D�mstedt" wrote:
> [EMAIL PROTECTED] (Herman Rubin) wrote:
> >Now the question which raised the fuss is how to do the
> >generating of the random integer between 0 and m-1. The
> >information in this is log_2(m). If one generates all
> >of them together, one can come close to this in the
> >number of bits used, but it can lead to numerical problems.
> >The usual procedure is to generate them one at a time.
>
> In the SG100 hardware random number generator, we
> generate numbers like these using the algorithm below.
> We see that, to guarantee a flat distribution, we must
> sometimes iterate. Note that, in the algorithm below,
> (multiples of) four bytes generates one number with a
> flat distribution 0..(m-1) for any 0<m<(2^32).
>
> Bo D�mstedt
> Protego Information AB
> IDEON,Lund,Sweden
> http://www.protego.se/sg100_en.htm
> (Full source available on our site)
>
> ulong SG100_Random( const ulong Select_Range)
> {
> BOOL Done = FALSE;
> ulong inc_scale;
> ulong count = ( ulong)( -1);
> ulong Rand_word;
>
> if ( Select_Range == 0)
> {
> // ERROR in input
> }
> else
> {
> inc_scale = 0xFFFFFFFF / Select_Range;
> if ( inc_scale == 0)
> {
> inc_scale = 1;
> }
>
> while ( ! Done)
> {
> Get_Noise( &Rand_word, one word of true noise);
> count = Rand_word / inc_scale;
> Done = count < Select_Range;
> }
> }
> return count;
> }
I can offer condolences. Are you expecting congratulations?
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
