Cryptography-Digest Digest #401, Volume #12 Thu, 10 Aug 00 16:13:00 EDT
Contents:
Re: OTP using BBS generator? (Terry Ritter)
Re: OTP using BBS generator? (Mok-Kong Shen)
Re: 1-time pad is not secure... (Jim)
Re: Software license software with PK ???? ("Joseph Ashwood")
Re: 1-time pad is not secure... ("Tony T. Warnock")
Re: Software license software with PK ???? ("Joseph Ashwood")
Re: Destruction of CDs ("Joseph Ashwood")
Re: Internet-based secret algorithm? ("Trevor L. Jackson, III")
Re: OTP using BBS generator? (Doug Kuhlman)
Re: BBS and the lack of proof (Mok-Kong Shen)
Re: 1-time pad is not secure... (Mike Andrews)
Re: OTP using BBS generator? ("Trevor L. Jackson, III")
Re: OTP using BBS generator? ("Trevor L. Jackson, III")
Re: BBS and the lack of proof (lordcow77)
Re: Not really random numbers ("Trevor L. Jackson, III")
Re: IDEA's current security (jungle)
Re: Destruction of CDs (jungle)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (Terry Ritter)
Subject: Re: OTP using BBS generator?
Date: Thu, 10 Aug 2000 18:53:54 GMT
On 10 Aug 2000 18:00:25 -0000, in
<[EMAIL PROTECTED]>, in sci.crypt lcs Mixmaster
Remailer <[EMAIL PROTECTED]> wrote:
>David Hopwood writes:
>> Note that the proofs in the BBS paper (and in the Crypto '84 paper by Vazirani
>> and Vazirani proving a reduction to factoring) are all asymptotic, so
>> unfortunately we can't make stronger statements relating the exact probability
>> of being able to distinguish the BBS output from random with a specific amount
>> of work, to the probability of being able to factor or solve the QRP with a
>> similar amount of work (at least, not based on those proofs). But if the
>> underlying question being debated in this thread is about the general validity
>> of probabilistic proof, rather than its application to BBS in particular, then
>> there are plenty of other cryptosystems for which exact reductions have been
>> proven.
>
>First, thanks to the reference to Vazirani&Vazirani. We can dispense
>with the awkward claim that BBS reduces to quadratic reciduosity, and
>simply say that it reduces to factoring. If you think you need to check
>for short cycles, then you think your opponent can factor your modulus
>by guessing cycles.
Obviously false: *I* think we all need to check for short cycles (if
we are going to claim proven security) AND *I* don't think an opponent
can factor N by guessing.
The need to check for short cycles is to avoid actually *using* a
short cycle and traversing that cycle, which is UNARGUABLY weak. Let
me say that again:
* THERE IS NO QUESTION that short cycles do exist in BB&S.
* THERE IS NO QUESTION that if we select x0 at random, sooner or
later we *WILL* select a short cycle.
* THERE IS NO QUESTION but that if we use and traverse a short cycle,
that *IS* insecure.
But none of this gives the opponent an advantage in guessing cycles.
One might think you hadn't even been following along.
>However, you have made one very unfortunate misstatement, which is that
>the proofs are asymptotic. This is not true, at least for the commonly
>understood meaning, which would be that they are asymptotic in N, the
>modulus, and so don't apply in general to any specific N. The proofs
>are NOT asymptotic in N. BBS/Vazirani shows very clearly that for ANY
>modulus, if you have an epsilon advantage for guessing the BBS sequence,
>you can factor THAT modulus.
>
>(Furthermore, as was shown here, the ability to find short cycles by
>guessing immediately leads to factoring in a much simpler way.)
>
>Terry Ritter has claimed in the past that BBS is only an asymptotic
>result,
Actually, I have given several alternatives which might explain the
reality we see: On the one hand, mathematics claims proven security,
and on the other, experimental evidence shows that insecurity exists.
Experimental evidence always wins. It is now necessary to explain why
the math does not agree. If you have a better explanation, we have
yet to see it.
>part of his general campaign to spread doubt on the technology.
Questioning my motives is not addressing the issue; it is instead
attempting to "win" by implying that you are more worth listening to
than I. Disturbing, and embarrassing, really, because my arguments do
not depend upon trusting me. The arguments can be understood on their
own by anyone who has even a modest understanding of random number
generators.
>This is completely mistaken and I am sorry to see you add credence to
>his misconceptions.
The misconceptions are yours, and apparently you will do anything you
can to avoid being forced to think about this. You have your idea and
you will not be moved.
Your idea is wrong. It is not true that factoring is unconditionally
hard. Factoring is easy when a factor is leaked. That is what the
reduced BB&S does when it uses a short cycle. So if we want to depend
upon factoring being hard, we had better arrange to not use a short
cycle.
---
Terry Ritter [EMAIL PROTECTED] http://www.io.com/~ritter/
Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: OTP using BBS generator?
Date: Thu, 10 Aug 2000 21:10:13 +0200
Terry Ritter wrote:
>
> <[EMAIL PROTECTED]> wrote:
> >In another follow-up I have argued for a replacement of the
> >term 'provable security' without having considered statistics.
> >Here is a modified version:
> >
> > 'existence of a rigorous security proof of statistical
> > nature contigent on fulfillment of certain assumptions'
>
> I think that hides the true situation. For the purposes of discussion
> we are willing to assume that factoring is difficult. Yet even *with*
> that assumption, the reduced BB&S without short-cycle checks will be
> weak occasionally. Here "occasionally" means "ALMOST never," instead
> of the absolute "never" we would like to see.
>
> The issue, then, is *not* the assumption, but instead the construction
> of the system to be secure when the assumption is true.
You are concerning some issues of the present thread with its
'specialities'. What I meant is that in GENERAL one should
replace in crypto discussions the term 'provably secure'
with the long phrase I proposed, in order to prevent 'general'
mis-interpretations.
BTW, I like to take this opportunity to repeat a few points:
(1) If indeed one could (though I doubt) quantitatively
investigate the distribution of the cycle lengths of the
output of the congruence relation, then one could assess
the difference between the 'reduced' and the 'full' version
in quantitative terms and hence allows the user to do his
choice. Apparently, however, there is no way of doing that
in theory conveniently, let alone in practice.
(2) As David Hopwood pointed out, BBS left entirely open
the issue of the relation between the cycle lengths of the
output of the congruence relation and the cycle length of
LSB of that. Since one IS using the LSB, NOT the direct
output of the congruence relation, there is NO sense to
claim having profited from 'provable security' of BBS at
all while employing the LSB, as long as this very essential
issue is not clarified. Indeed, it seems to be more
'economical' to wait for the clarification of that before
further persuing discussion of the issue of reduced
vs. full version. For, if LSB of BBS turns out to have
mostly very short cycle lengths (even if the output of the
congruence relation does not) or if LSB has very poor OTHER
statistical qualities, e.g. failing to be uniform or failing
the serial tests, then one can 'forget' BBS from the outset.
(3) As I suggested in a previous follow-up (before I came
up with the example leading to LSB of 0000.....), one MUST
do an amount of statistical tests on BBS, just like ANY
PRNG that is used in numerical computations (not necessarily
crypto) has to be tested. I am not aware of any such
PRNG (excepting BBS) that has been 'exempted' from tests
simply because theory says that it must be good. This work,
though presumably not simple/convenient, MUST be done, if
BBS is to be applied in practice. Otherwise, one is not
acting according to scientific ways and is cheating oneself
or believing religious doctrines. (There seems to be no
easily discernable relation between the cycle length of the
output of a PRNG in general and the LSB. For certain linear
congruential PRNGs it is well-known that the LSB always
alternates between 0 and 1, i.e. has a cycle length of 2
and is thus entirely independent of the cycle length of the
output of the congruence relation, which may be huge under
circumstances.)
M. K. Shen
=============================
http://home.t-online.de/home/mok-kong.shen
------------------------------
From: [EMAIL PROTECTED] (Jim)
Subject: Re: 1-time pad is not secure...
Date: Thu, 10 Aug 2000 18:00:24 GMT
Reply-To: Jim
On 10 Aug 2000 11:48:56 GMT, [EMAIL PROTECTED] (Guy Macon) wrote:
>Mike Calder wrote:
>
>>It may be unpredictable, but does that make it random?
>
>For use as the key in a one time pad, isn't unpredictable good enough?
Yes. Until a method of generating and measuring a perfect random
key is discovered!
Good enough to prevent cryptanalysis if not torture-analysis.
--
Jim Dunnett
amadeus at netcomuk.co.uk
nordland at lineone.net
g4rga at thersgb.net
------------------------------
From: "Joseph Ashwood" <[EMAIL PROTECTED]>
Subject: Re: Software license software with PK ????
Date: Thu, 10 Aug 2000 12:00:58 -0700
But the length of the key determines the length of the block, so a 1024-bit
key used for ElGamal will result in a 2000-bit encrypted block. Going even
in to block ciphers, they require that the plaintext and ciphertext match
certain block sizes, the same requirement holds with PK, just the sizes are
vastly larger, and so more noticable.
Joe
"Benny Nissen" <[EMAIL PROTECTED]> wrote in message
news:82Ck5.12319$[EMAIL PROTECTED]...
> I can not see why it is so that a public key algorithms may need to
inflate
> the size of the encrypted data. The strongness/security of the algorithm
> must be based on the keys and not based on the length of the encrypted
data.
> Sorry this may be a stupid statement, but it seam to me that everybody
look
> in the same historical direction when implementing PK systems. (because I
am
> unable to understand why the security of the algorithm is based on the
> length of the encrypted data)
>
> Benny
------------------------------
From: "Tony T. Warnock" <[EMAIL PROTECTED]>
Subject: Re: 1-time pad is not secure...
Date: Fri, 11 Aug 2000 01:01:53 -0600
Reply-To: [EMAIL PROTECTED]
Tumbleweed wrote:
> Guy Macon <[EMAIL PROTECTED]> wrote in message
> news:8mtvus$[EMAIL PROTECTED]...
> > Runu Knips wrote:
> > >
> > >fvw wrote:
> > >> <8mth1u$vpt$[EMAIL PROTECTED]> ([EMAIL PROTECTED]):
> > >> >Can you generate truly random numbers? No.
> > >
> > >> yes. time between radioactive decays for instance is a
> > >> textbook example of a perfect random generator.
> > >
> > >Yep.
> > >
> > >I'm very surprised to hear someone believes true
> > >random isn't available. Shows a serious lack in
> > >ideas about modern physics, doesn't it ?
> >
> > Actually, oddly enough, what I learned in Seminary explains why we
> > keep seeing this idea much better than anything I ever learned in
> > a Physics class.
> >
> > There is a branch of theology that seems to be influencing people
> > who don't know the root source of the ideas they hold. I refer, of
> > course, to Fatalism.
> >
> > One particular branch of Fatalism is largely based on the idea of a
> > pure Newtonian universe where, if we only knew the exact position,
> > velocity, and all other information about every particle that exists,
> > we could predict the future with 100% accuracy forever. Thus all
> > future event are foreordained and free will is an illusion.
> >
> > Heisenberg killed this theory, Chaos theory nailed the coffin shut,
> > and Quantum Mechanics presided over the cremation. Alas, by this
> > time enough people were infected with the "no randomness" meme that
> > it became a self-sustaining memeplex which attempts to propagate
> > into sci.crypt on a regular basis.
> >
> >
> It should have been dead before Heisenberg, I have even read that Newton
> made a statement (not that I could point to a source) that not all events
> are predicable in detail simply because some bodies will have velocities
> measured as an irrational numbers, and therefore can only be computed to a
> particular but not perfect detail. I wonder how it arose in the first place
> since the maths around at Newton's time was enough to disprove this, wasn't
> it?
Oresme did similar computations in the twelfth(?) century.
------------------------------
From: "Joseph Ashwood" <[EMAIL PROTECTED]>
Subject: Re: Software license software with PK ????
Date: Thu, 10 Aug 2000 12:06:16 -0700
> I would like to be able to generate a registration without any specific
> knowledge about the end user.
There's no requirement that you bind any user information to the public key.
A public key is just a number, the other information they send you is
actually of much more import (like their billing information). But it's your
choice. If you don't want to force the client to generate a public key, have
them generate a key for a secret key algorithm (Rijndael, Twofish, Serpent,
3DES, etc), encrypt it to your (RSA) public key, and send it that way. Since
you need more than just that information anyway, you shouuld also include
the various other information in the single block to decrease the sending
size.
Joe
------------------------------
From: "Joseph Ashwood" <[EMAIL PROTECTED]>
Subject: Re: Destruction of CDs
Date: Thu, 10 Aug 2000 12:10:21 -0700
>From a theoretic standpoint a magnet could have a detrimental effect on a
cd, but with the size field you'd have to generate to do it, you'd cause
problem with my car first, no matter where you are in the world (remember
you can only get as far away from me as the diameter of the earth give or
take).
"Tom Anderson" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> On Thu, 10 Aug 2000, Mok-Kong Shen wrote:
>
> > Thomas Kellar wrote:
> >
> > > There was a thread on this topic a couple of weeks ago.
> > > I received an advertisement for a device that shreds
> > > CDs. If anyone is interested the company name/address is
> >
> > Wouldnt a very strong magnetic field help?
>
> help wipe a CD? now, i'm no physicist, but i thought CDs were optical
> media, so a magnetic field should have no effect. unless you're hoping to
> twist the electrons out of their orbits - that's one helluva field!
>
> i once went on a tour of the magnet lab in the university physics
> department; they make huge superconducting coils to produce immense fields
> for, er, scientific purposes. the problem is that a coil always sets up a
> field such that the current moving through the coil exerts an outward
> force on the wire (left-hand motor rule and all that), so the coils have
> an unfortunate tendency to explode ...
>
> tom
>
------------------------------
Date: Thu, 10 Aug 2000 15:18:00 -0400
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: Internet-based secret algorithm?
Max Polk wrote:
> Would an Internet-based secret algorithm be worthwhile? What I mean by
> "Internet-based" is the following:
>
> 1. You find lots of web sites, usenet posts, etc., from all over the
> world.
> 2. According to a secret algorithm, you extract bytes of text from them,
> extract chunks of bits within images on them, extract things from Acrobat
> PDF files on some of them, etc.
> 3. Use the above data as your key to encrypt your plaintext.
>
> We are currently *VERY FOCUSED* on having all the information you need to
> decipher a message inside that message (public key crypto
> notwithstanding).
>
> This strong focus makes cracking an encrypted message a simple matter of
> number crunching on a very big computer before it is broken.
>
> With this Internet-based secret algorithm, you are spreading out the
> information you need to decipher the message all over the world on
> various web pages, inside images, tucked away in various places.
>
> The raw amount of information on the Internet makes the likelihood of
> simple number crunching on the message impossible. After all, what bytes
> would you pick from which web site as your source for number crunching?
>
> Furthermore, what possible pattern could be found to weaken the secret
> algorithm? It is quite impossible to take all the information on the
> Internet and come up with all possible keys. What's so good is that the
> Internet total data size is still growing rapidly.
IBD reported an estimate of 350 billion web pages about 10 days ago. That's
less than 39 bits of security from to page selection. The time to fetch each
page is long compared to the time required to trial decrypt (say) 3DES, but
the overall space is far to small to provide any real security.
------------------------------
From: Doug Kuhlman <[EMAIL PROTECTED]>
Subject: Re: OTP using BBS generator?
Date: Thu, 10 Aug 2000 13:51:58 -0500
Terry Ritter wrote:
>
<SNIP>
>
> No; a "negligable probability" means that some probability remains.
> And with random selection, that result will eventually occur.
>
You should know better than that. The probability that the sound of air
coming through a naturally shaped tunnel will play the entire
VeggieTales collection is non-zero, but it's not gonna happen in the
lifetime of the universe. Same thing applies here.
>
> That logic is wrong. If there is a possibility of choosing a short
> cycle, that *will* happen, sooner or later. Then the attacker *can*
> factor N, which contradicts the assumption.
>
You consistently confuse possibility with probability and claim that one
is the other. Read above.
>
> Were this to be explained as it really is, I doubt that many users
> would be happy with the phrase "proven secure."
>
Well, if the other issues could be cleaned up (like how the size of the
overall cycle corresponds with that of the LSB cycle), I think almost
everyone would, if they really understood what "neglible" likelihood
meant.
Doug
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: BBS and the lack of proof
Date: Thu, 10 Aug 2000 21:35:59 +0200
tomstd wrote:
>
> Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
> >
> >
> >tomstd wrote:
> >>
> >
> >> Given two primes
> >>
> p=121012662526787295907262401512751757545611582897620391004818266
> >> 981159050711
> >>
> >> and
> >>
> >>
> q=375132239070794634471679739337309743812131772704924806435878390
> >> 190959014553
> >>
> >> and a starting x[0] of 1291842616032279148102643839788703561
> >>
> >> What is the period of this generator?
> >
> >You wouldn't get any figure of the period. I guess the answer
> >is likely to comprise of: (1) According to the 'mathematics' in
> >the BBS paper, the output of the congruence relation is very
> >very likely to be very very very big. (2) What the period of
> >the LSB of the output is (a matter that interests you) does
> >not belong to 'admissible' topics about BBS (because the paper
> >left open that question) and is hence 'by definition' of no
> >interest, point.
>
> Well what if I was making a prng I would really like to know the
> period. How do you know the period is not just seven outputs?
>
Well, 'in principle' you can run the generator and determine
the period, just like I have found (by hand) the cycle
(38, 190, 152, 114) for n=209. In practice, you of course
have troubles, if your generator is large. And after that
you have further to determine the period of the LSB. (In my
example it is 1). There appears to be in the case of BBS
hardly any theory known that enables you to calculate
or estimate the period of LSB, which is 'really' what you
are interested in. So you are left to your own. On the other
hand, it is possible in my humble view to 'realistically'
fill the 'vacuum' left by the theory through performing
extensive (hence probably expensive) experiments, thereby
gaining certain (though not in the absolute sense) confidence
of whether very short periods of LSB are likely to occur or
not. Before some such data are available, I would in your
place delay applying BBS and go meanwhile drinking some tea.
M. K. Shen
------------------------------
From: [EMAIL PROTECTED] (Mike Andrews)
Subject: Re: 1-time pad is not secure...
Date: Thu, 10 Aug 2000 19:27:15 GMT
Scripsit Tumbleweed <[EMAIL PROTECTED]>:
: I have even read that Newton
: made a statement (not that I could point to a source) that not all events
: are predicable in detail simply because some bodies will have velocities
: measured as an irrational numbers, and therefore can only be computed to a
: particular but not perfect detail. I wonder how it arose in the first place
: since the maths around at Newton's time was enough to disprove this, wasn't
: it?
What makes you think that Newton's statement is incorrect?
--
[S]tandard complaint. Fish, barrel, tacnuke.
-- Red Drag Diva, in alt.sysadmin.recovery
------------------------------
Date: Thu, 10 Aug 2000 15:27:54 -0400
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: OTP using BBS generator?
Mark Wooding wrote:
> Trevor L. Jackson, III <[EMAIL PROTECTED]> wrote:
>
> > Interesting verb: "find". AFAICT the issue is not finding short
> > cycles by searching for them, but finding a short cycle in the "oops"
> > sense of having inadvertently selected one for use. The practical
> > impossibility of finding one on purpose is independent of the
> > theoretical possibility of finding one by accident.
>
> Errr... no.
>
> If finding X by trying very hard is impractically difficult, then
> finding X by accidentally tripping over it must be at least as
> difficult. Otherwise, I have the algorithm for finding X by trying very
> hard: pick possible values at random and hope to trip over one by
> accident. This must work unless X can read minds and is deliberately
> perverse.
Two conterclaims:
1) The space of short cycles is _larger_ than the space of factors to
evaluate. This it is not as hard to pick a bad (short) key as it is to find
the factors of a long cycle. I'm interested in detailed refutations of this
claim if you are able to mention any.
2) The proposed algorithm fails because "tripping over X" works by finding
_any_ short X rather than _the_ X selected. This appears obvious. Am I being
stupid?
------------------------------
Date: Thu, 10 Aug 2000 15:38:14 -0400
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: OTP using BBS generator?
Mark Wooding wrote:
> Terry Ritter <[EMAIL PROTECTED]> wrote:
>
> > From my point of view, the whole reason for a proof is to absolutely
> > guarantee something. The sort of proof we have been discussing simply
> > does not do that, presumably because it is not really the same sort of
> > "proof" that students learn in algebra. I assume that what we really
> > have is a *statistical* proof, which is *not* just a different form of
> > proof and just as good, but instead a *lesser* *standard* of proof.
>
> Errr... no. The proof not statistical. It states that the output of a
> BBS generator cannot be distibguished from random data by any
> polynomial-time test by an adversary who cannot decide quadratic
> residuosity.
Is it your position that there are repeating decimals that have cycles so long
that they are are indistinguishable from irrationals?
------------------------------
Subject: Re: BBS and the lack of proof
From: lordcow77 <[EMAIL PROTECTED]>
Date: Thu, 10 Aug 2000 12:38:21 -0700
tomstd <[EMAIL PROTECTED]> wrote:
>Therefore I submit that all BBS generators have a period under
>10, prove me wrong without empiracle evidence.
>
IF all BBS generators have a period under 10, we can factor and
decide quadratic residiousity for any composite. We select a non
quadratic residue x such that Jacobi(x/n)=-1. We feed this x
into the BBS generator, obtaining a first value of x_1 and use
the guaranteed short cycle to find an x_prime leading back to
x_1. x is a square root of x_1 mod n, as is x_prime. x!=x_prime
because one is a QR and the other is not; this tells us that
x^2=x_prime^2 mod n, the same relationship that we seek to
obtain in the QFS or NFS. GCD(x-x_prime,n) will be a factor of
n. We can factor n and consequently we can decide quadratic
residiousity for n using your short cycle in *constant time*.
Thus, computational complexity theory is turned upside down, you
collect your Fields medal, you quickly become the richest person
on this planet, and win everlasting fame.
===========================================================
Got questions? Get answers over the phone at Keen.com.
Up to 100 minutes free!
http://www.keen.com
------------------------------
Date: Thu, 10 Aug 2000 15:43:24 -0400
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: Not really random numbers
The title "Absolutely Random" is hilarious when applied to a deterministic system.
Anthony Stephen Szopa wrote:
> Jamie wrote:
> >
> > In the UK pre-Pay phone cards are big business... you buy a card, reveal a
> > number, key the number to a phone system and you have so much talk time. I
> > am working on an application in a simmilar field...and ofcourse the issue of
> > generating these numbers has come up once again. I need ideas for a number
> > generator that satisfy the following contidions:
> >
> > 1 The magnitude of the generated numbers can be specified, 2^30, 2^35,
> > 2^40... 2^90
> >
> > 2 The period must be greater then 2^^20
> > (So numbers generated dont repeat)
> >
> > 3a Given a short fragment of the sequence it must be difficult to deduce the
> > next number in sequence
> > 3b Given one number it must be unlikely that another number is both close in
> > value and close in position in the sequence
> > (vague but I guess I mean that a "hacker" wont succed randomly guessing the
> > next number)
> >
> > 4 The sequence must be re-startable.
> >
> > 5 No need for an even distribution or anything like that.
> >
> > My starting point was an algorithm like
> >
> > Nn+1=(P1*Nn+P2) mod P3
> >
> > P1,2,3 are primes P3 determining the magnitude of the numbers generated
> >
> > Nn+1 the next number in the sequence
> >
> > But this seems to be full of holes.
> >
> > any ideas on an algo ?
>
> Go to http://www.ciphile.com and download OAR-L3: Original
> Absolutely Random - Level3 random number generator shareware
> software.
>
> Go to the Downloads Currently Available web page and download the
> software directly. You will be able to generate more random numbers
> than you could conceivably ever need.
>
> If used according to recommendations there is practicably no chance
> anyone will be able to duplicate your random numbers.
>
> If you think you could use this software commercially, email me.
>
> A.S.
------------------------------
From: jungle <[EMAIL PROTECTED]>
Subject: Re: IDEA's current security
Date: Thu, 10 Aug 2000 15:43:02 -0400
very nice approach ...
when I'm looking from block size perspective, EXACTLY as secure as IDEA ...
when I'm looking from key size perspective, BF is securer than IDEA ...
Runu Knips wrote:
>
> Stephan Eisvogel wrote:
> > Runu Knips wrote:
> > > IDEA (1992) isn't much older than Blowfish (1994), and
> > > because its proprietary it doesnt get as much analysis
> > > as Blowfish I think.
> >
> > I don't remember where I read this but before AES candidates
> > appeared, IDEA was No.2 of *the* most crypt-analyzed
> > algorithms (right after DES).
>
> Yes, but it is hard to really do such statistics. There is
> not much cryptanalysis of Twofish around, for example. Does
> that mean nobody has cryptanalysed it ? Bruce Schneider
> and his Twofish team said this is because nobody has found
> a weakness, so there was not much to write about.
>
> So the main reason why people believe IDEA got more
> cryptanalysis than Blowfish might be that people have found
> more to write about it.
>
> This situation remembers me a little bit about the claim of
> many programmers about the most often used language. I have
> heared about FORTRAN, Cobol, Basic, C, C++ and many other
> languages that they are the most often used one. But it is
> next to impossible to proof such claims. I think the main
> reason for such claims is that people like that language.
>
> So I think the main reason for IDEA being the at the second
> place is that (a) many people like it [it is theoretically
> very beautiful] and (b) many people have found something to
> write about it.
>
> In fact, I believe Blowfish is at least as secure as IDEA,
> and it needs neither multiplications nor a license.
when I'm looking from block size perspective, EXACTLY as secure as IDEA ...
when I'm looking from key size perspective, BF is securer than IDEA ...
------------------------------
From: jungle <[EMAIL PROTECTED]>
Subject: Re: Destruction of CDs
Date: Thu, 10 Aug 2000 15:47:27 -0400
don't burn them, pollution & toxic fumes it will create ...
Thomas Kellar wrote:
>
> There was a thread on this topic a couple of weeks ago.
> I received an advertisement for a device that shreds
> CDs. If anyone is interested the company name/address is
>
> Schleicher & Co. of America, Inc.
> 5715 Clyde Rhyne Dr.
> Sanford, NC 27330-9909
>
> ph: 1 800 775 7570 email: [EMAIL PROTECTED]
>
> They claim their "501 CD shredder" can eliminate 800 to
> 1200 CDs or credit cards per hour.
>
> A disinterested party. (Actually uninterested, I would burn them
> myself.)
don't burn them, pollution & toxic fumes it will create ...
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
