Cryptography-Digest Digest #443, Volume #12 Mon, 14 Aug 00 20:13:01 EDT
Contents:
Re: Proposal of drafting rules of conduct of posting (wtshaw)
Re: Let us have Lattice (wtshaw)
Re: 1-time pad is not secure... (Tim Tyler)
Re: WinACE encryption algorithm (tomstd)
Re: OTP using BBS generator? (Terry Ritter)
Re: OTP using BBS generator? (Terry Ritter)
Re: 1-time pad is not secure... (Tim Tyler)
Re: WinACE encryption algorithm (Leroy Kimna)
Re: chap authentication scheme? (Cryptocol)
Re: 1-time pad is not secure... (Tim Tyler)
Re: Proposal of drafting rules of conduct of posting (Future Beacon)
Re: 1-time pad is not secure... (Tim Tyler)
Re: 1-time pad is not secure... (Tim Tyler)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (wtshaw)
Subject: Re: Proposal of drafting rules of conduct of posting
Date: Mon, 14 Aug 2000 15:29:58 -0600
In article <[EMAIL PROTECTED]>, Mok-Kong Shen
<[EMAIL PROTECTED]> wrote:
> Note: I was called attention to the fact that an issue
> that is 'buried' in a thread about another issue is not
> likely to be noticed by many. So the following is a
> re-post of what I sent a few hours ago.
>
>
> I have a suggestion. Wouldn't it be nice that we have
> some thing that I temporarily term to be general rules of
> conduct of posting to the group?
You either have censorship or you don't. Conduct can be objectionable or
passable according to anyones set of criteria, and not exactly the same to
someone else. If there is one thing that I cannot stand myself it is a
credentials committee to see who is politically or technically correct in
an open forum.
Whther you embarrass yourself or someone else is beside the point if
critical information still has exposure and distribution. Things do tend
to even themselves out, but if freedom bothers anyone, that is their
problem.
It is said that the difference between an expert and otherwise is that an
expert tends to make his mistakes in private. The attitude here is to
give and take in rapid manner, good, bad, indifferent, technical,
cryptopolitical, or other crypto area. The only measure is that the raft
drifts somewhat in a crypto direction and that people who want to climb on
board are welcome to try to do so.
You and I have the luxury of making mistakes, and the relatively certain
assurance that someone will correct you. I, for one, want feedback when
I say something dumb, which can happen. Or, if someone asks a dumb
question, that is something that might be answered.
I wonder more if no one points out some glaring problem. Let me give a
good example: I was overly excited about some prospective ciphers lately,
products of latenight magical thinking. Breaking my own rules, it has
happened before, I posted without thinking sufficiently and actually
making algorithms work. So, I confess, Lattice and Sinnet at best are
hashes, be it suggestive of a whole family of them. The ciphers are not
invertable at all, maybe should be not even be called ciphers.
Why did no one catch this? My face is red. I screwed up. I had
extensive communication directed at my own shaddow, and lack of response
should not have been taken as anything positive. I accept my being human,
and everyone else being that way too; we all like to never make mistakes,
never get a bit too zealous, or post in an less that productive manner.
If you find that you get offended, wear your asbestos suit; better yet,
don't wear you feelings on your shoulder, become humored by indiscression,
it must be Hillery's way, and it beats Sophie's choice.
Mike Goodwin's imperative that the answer to bad speech is more speech
applies to all our discussions. If you must only dine with lace
tablecloths, you may go someday get very hungry.
--
Too bad from the party members point of view that Ventura has
gone, for what the Reform Party needs is a good referee and
someone who understands how to *fix* things, before hurt sets in.
------------------------------
From: [EMAIL PROTECTED] (wtshaw)
Subject: Re: Let us have Lattice
Date: Mon, 14 Aug 2000 15:56:08 -0600
In article <[EMAIL PROTECTED]>,
[EMAIL PROTECTED] (wtshaw) wrote about some about interesting cipher
design ideas.
As mentioned elsewhere, I made a mistake, trivial or big, should have
thought farther before saying so much. The propopsed inverse functions
say it all, if everything is divided by two, then you cannot have a value
of adding and subtracting several values that might yield an odd value
before the division.
Pardon folks, some interesting hashes can be generated with these
ideas....more fodder for thought or nibbling for me. Darn it, must have
gotten my eyes switched about, as I did not see the simple error.
--
Too bad from the party members point of view that Ventura has
gone, for what the Reform Party needs is a good referee and
someone who understands how to *fix* things, before hurt sets in.
------------------------------
From: Tim Tyler <[EMAIL PROTECTED]>
Subject: Re: 1-time pad is not secure...
Reply-To: [EMAIL PROTECTED]
Date: Mon, 14 Aug 2000 22:43:31 GMT
Simon Johnson <[EMAIL PROTECTED]> wrote:
: Saying there isn't 'real' randomness is rubbish.
Needless to say, I don't agree. There /may/ be no "real" randomness.
However its quite possible that our knowledge of physics will never
"bottom out" and we'll remain ignorant about whether randomness exists
or not. Certainly today, nobody knows.
: Quantum physics says there is and i'm not gonna argue with that.
Except that it doesn't say any such thing. Completely deterministic
interpretations of quantum theory exist, namely - for example - the MWI.
Such interpretations make no use of random events - and are consistent
with all observations to date.
: At the end of the day, the security of the OTP is based on trust that
: the source is perfectly random. Wether it truely is or isn't is
: irrelevent; its the belief that the cipher-text was enciphered
: under the OTP construction that determines its security.
This statement is false. Belief does not come into it.
: After all if you can't prove a source isn't random, then it must
: therefore be random, and the argument stands.
If *you* can't prove a source isn't random, that may reflect your
capabilities, rather than those of the source.
If no proof in principle exists, then the source will be a random one -
but how could anyone ever possibly know that no proof in principle exists?
There are an infinite number of possible proofs. No one can check them all.
--
__________ Lotus Artificial Life http://alife.co.uk/ [EMAIL PROTECTED]
|im |yler The Mandala Centre http://mandala.co.uk/ Namaste.
------------------------------
Subject: Re: WinACE encryption algorithm
From: tomstd <[EMAIL PROTECTED]>
Date: Mon, 14 Aug 2000 15:59:51 -0700
lordcow77 <[EMAIL PROTECTED]> wrote:
>tomstd <[EMAIL PROTECTED]> wrote:
>>"Marc Beckersjuergen" <[EMAIL PROTECTED]> wrote:
>>>Hey, I'm just the webmaster, not the developer
>>>and I don't know squat about programming in general and
>>encryption in
>>>particular :-)
>>
>>So do something smart and go get a developer? Geez...
>>
>
><flame>
>There's something called tact. You might consider learning about
>it before tackling impossible differentials.
></flame>
What is this suppose to mean? I have posted what I think about
the attack and nobody has stepped forward to help. Only David
who said "ooh ooh impossible differentials, I know this one!".
No offense, honestly but please help me! I want to learn how the
attack works.
>Couldn't help myself.
Then why did you post?
Tom
===========================================================
Got questions? Get answers over the phone at Keen.com.
Up to 100 minutes free!
http://www.keen.com
------------------------------
From: [EMAIL PROTECTED] (Terry Ritter)
Subject: Re: OTP using BBS generator?
Date: Mon, 14 Aug 2000 23:07:47 GMT
On Mon, 14 Aug 2000 21:11:21 GMT, in
<[EMAIL PROTECTED]>, in sci.crypt Benjamin Goldberg
<[EMAIL PROTECTED]> wrote:
>Terry Ritter wrote:
>[snip]
>> The need to check for short cycles is to avoid actually *using* a
>> short cycle and traversing that cycle, which is UNARGUABLY weak. Let
>> me say that again:
>
>> * THERE IS NO QUESTION that short cycles do exist in BB&S.
>Agreed.
>
>> * THERE IS NO QUESTION that if we select x0 at random, sooner or
>> later we *WILL* select a short cycle.
>Agreed. But, will it happen in the lifetime of the universe?
>
>> * THERE IS NO QUESTION but that if we use and traverse a short cycle,
>> that *IS* insecure.
>Agreed. But, if it occurs two universe-lifetimes from now, should
>I worry?
As I have stated many times, I think shot cycles are not a weakness in
practice. Instead, I am most concerned with the meaning of
cryptographic proof. For, if we have an example where weakness can
occur, then, clearly, cryptographic proof has failed to prevent that
weakness. Given one such example, we have to ask if more exist. If
then the answer is "No, because that would break math," we have to ask
how the original problem could possibly exist in the first place. I
think we are now coming to a consensus position in which cryptographic
proof has far less practical import than most of us previously
thought.
>[snip]
>> Your idea is wrong. It is not true that factoring is unconditionally
>> hard. Factoring is easy when a factor is leaked. That is what the
>> reduced BB&S does when it uses a short cycle. So if we want to depend
>> upon factoring being hard, we had better arrange to not use a short
>> cycle.
>
>Hmm, in your short cycle example (PQ=1081, and the cycle length 11, I
>believe), how do we learn the factors of PQ from the LSBs of that cycle?
Bryan Olson has made that claim repeatedly, and I accepted that.
But even if short cycles do not expose factoring, they certainly do
expose the sequence. When a sequence repeats we can predict it. So
if we can predict without being able to factor we have yet another
interesting situation with respect to proof claims.
After thinking about these issues for the last day or so, I think that
part of our problem ultimately stems from a language ambiguity in the
word "assumption." In reality there is not just one but many
necessary assumptions.
I would call "factoring is hard" a "major" assumption, because it is
directly connected to extensive math reasoning. But other,
*additional*, assumptions are *also* necessary, like "do not broadcast
the factors" or "do not allow the system to expose the factors." I
would call these "minor" assumptions, because they are connected with
particular implementations and use. The distinction makes sense,
because, obviously, a system can fail without impacting all of math.
The ambiguity I see is that secure operation depends upon *all* the
assumptions, major and minor. So if we have a situation where BB&S is
weak, it is simply false to say it must mean that we can now prove a
major math assumption is wrong: Since *all* assumptions are required
for security, the lack of *any* *one* may be the cause of failure. It
is simply incorrect reasoning to say that a BB&S system must be secure
because we believe in the major math assumption.
One implication of this is that we do not -- and presumably *can* not
-- have a comprehensive list of minor assumptions. Yet until we have
such a list, we cannot verify that all needed assumptions have been
met. This situation has an uncanny resemblance to conventional
cryptography, where if we just knew every problem that could occur, we
could fix them all and have a "provably" secure cipher. Ciphers both
with and without proof may have similar problems in practice.
---
Terry Ritter [EMAIL PROTECTED] http://www.io.com/~ritter/
Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
------------------------------
From: [EMAIL PROTECTED] (Terry Ritter)
Subject: Re: OTP using BBS generator?
Date: Mon, 14 Aug 2000 23:07:53 GMT
On Mon, 14 Aug 2000 11:00:47 GMT, in <[EMAIL PROTECTED]>, in
sci.crypt Tim Tyler <[EMAIL PROTECTED]> wrote:
>[...]
>One problem appears to be whether an attacker can identify a short cycle.
>If he sees "123412341234..." in the low bits is he safe to assume the
>generator is in a cycle? It seems unlikely - since the next digits
>/might/ be 8, 5, 9 and 4. It appears that if the observed pattern is
>longer than the langth of the key, the possibility of mis-identifying
>a cycle diminishes rapidly.
>
>If Terry Ritter is correct - and detecting short cycles is possible - it
>appears that any analogy between "weak keys" in an OTP and "weak seeds"
>in a BBS generator absolutely breaks down.
As usual, our large conversation has included many different
assumptions and arguments. Normally, if we are talking about
"weakness" in a generator, I think the opponents have access to the
output of the generator. That can be reasonable, because many such
generators are used in additive stream ciphers, so with a
known-plaintext attack the generator output is exposed.
In BB&S we don't get the full state output, but we do get a bit of it,
and if we record that sequence and compare it to the incoming data,
presumably we can find a match. (There is a potential lead-in prior
to getting on a cycle, but I think that is limited to a single step.)
Presumably, after we get a few hundred successive bit matches, we can
reasonably believe we have found a cycle. Then, with just a little
more data, we can probably narrow down the cycle length to within a
few bits, which should be more than good enough to try them all.
This whole discussion is theoretical, generally addressing the meaning
of cryptographic proof. I'm unaware of any controversy about the idea
that cycles theoretically could be detected easily.
---
Terry Ritter [EMAIL PROTECTED] http://www.io.com/~ritter/
Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
------------------------------
From: Tim Tyler <[EMAIL PROTECTED]>
Subject: Re: 1-time pad is not secure...
Reply-To: [EMAIL PROTECTED]
Date: Mon, 14 Aug 2000 22:49:05 GMT
Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
: I guess that even a perfect OTP could leak information in
: one sense, namely, in situations where the fact whether the
: sender sends any message at all to the receiver could give
: some clue to the opponent.
It seems to be common practice not to mention the information supplied by
the very transmission of a message - unless you're discussing traffic
analysis rather than cryptography. The length of the message often also
supplies information to the attacker - and this is also mentioned rarely.
I guess this is to prevent tedious overqualification of basic issues.
--
__________ Lotus Artificial Life http://alife.co.uk/ [EMAIL PROTECTED]
|im |yler The Mandala Centre http://mandala.co.uk/ Namaste.
------------------------------
From: [EMAIL PROTECTED] (Leroy Kimna)
Subject: Re: WinACE encryption algorithm
Date: Mon, 14 Aug 2000 23:19:29 GMT
"Marc Beckersjuergen" <[EMAIL PROTECTED]> wrote:
>Hey, I'm just the webmaster, not the developer
>and I don't know squat about programming in general and encryption in
>particular :-)
I guess that puts your previous statement into a substantially different
light then, doesn't it?
"Marc Beckersjuergen" <[EMAIL PROTECTED]> wrote:
>... The encryption is pretty tight...
Just keep in mind that there's no such thing as "basically a 160 bit
Blowfish code". There's only one Blowfish and "basically" doesn't cut it.
Your people have either properly implemented it or they haven't, and you're
not giving us very much confidence at this point. In fact, the only way we
can really know for sure is if the source code is released.
--
"Leroy Kimna" is actually 7651 894032 <[EMAIL PROTECTED]>.
01234 56789 <- Use this key to decode my email address and name.
Play Five by Five Poker at http://www.5X5poker.com.
------------------------------
From: [EMAIL PROTECTED] (Cryptocol)
Subject: Re: chap authentication scheme?
Date: 14 Aug 2000 23:25:37 GMT
Thomas Wu wrote:
>> A-CHAP was again:
>> Alice <-- g^x -- Bob
>> Alice -- (g^xg^v)^y, h(g^y) --> Bob
>The problem here is that both Alice and Bob store g^v, so that if someone
>reads g^v from Bob's database, he can impersonate Alice to him. One of
>the initial requirements was that the server verifiers not be password
>equivalents.
>
Hmm. Both of them use "v" (=f(p)) rather than g^v mod N. ;) Anyway they have a
text-equivalence. So, already I mentioned that A-CHAP improved only ONE THING
from CHAP; security against passive attacks. Mr. Unruh also pointed it out. No
repeat any more. :)
>Why not try a simple DH/Elgamal approach:
>
>0. Alice and Bob agree on g, p (DH parameters).
> Alice knows the password r, Bob stores H(r).
>1. Bob sends g^x
>2. Alice sends g^y and S=r*(g^x)^y
>To verify, Bob computes r'=S/(g^y)^x and sees if H(r') == H(r).
>
>This just sends the password down the channel Elgamal encrypted with the
>DH session key. This naive approach is essentially what ssh user
>authentication does; it is totally vunlerable to fake server attacks,
>since an impersonated server gets the password, but if people don't
>notice this serious problem in ssh, you can probably "get away with it"
>as well in a CHAP variant.
>
It may solve text-equivalnce by encrypting password though fake Bob can read a
"plain password" even without launching dictionary attacks. Good suggestion!
------------------------------
From: Tim Tyler <[EMAIL PROTECTED]>
Subject: Re: 1-time pad is not secure...
Reply-To: [EMAIL PROTECTED]
Date: Mon, 14 Aug 2000 23:03:11 GMT
Guy Macon <[EMAIL PROTECTED]> wrote:
: Tim Tyler wrote:
:>John Savard <[EMAIL PROTECTED]> wrote:
:>: If the key is produced by, for example, rolling dice by hand, I am not
:>: exactly sure how one would even begin attempting to 'duplicate' the
:>: key generation process in order to arrive at the same, or a similar,
:>: sequence of numbers.
:>
:>A similar sequence of numbers may not be necessary - only that the key
:>may be duplicated "to some probability".
:>
:>Even a /tiny/ bias - of the type expected with casino dice - may be
:>sufficient to leak information:
:>
:>You should be able to reject the possibility that the cyphertext
:>represents a given plaintext with a high level of confidence - even if the
:>bias in the OTP is very small - provided with a large enough message.
:>
:>This is a leak.
: If you calculate "large enough" and it comes out larger than the total
: amount of information that our universe can hold, this is not a leak.
Not a leak of any practical significance.
In the case in question, I suspect with the type of dice used in casinos,
a 1-bit break would come with a relatively small quantity of information,
perhaps somewhere between a Kb and a Mb.
Such dice don't /need/ astronomical precision, since the house's margin
is likely to outweigh any bias in the dice. Consequently the chances are
that the money spent on providing such precision will not have been
expended in the first place.
Indeed, in reality, casinos have been known to use equipment so defective
that a statistician can use the biases in the equipment to beat the house.
--
__________ Lotus Artificial Life http://alife.co.uk/ [EMAIL PROTECTED]
|im |yler The Mandala Centre http://mandala.co.uk/ Namaste.
------------------------------
From: Future Beacon <[EMAIL PROTECTED]>
Subject: Re: Proposal of drafting rules of conduct of posting
Date: Mon, 14 Aug 2000 19:24:40 -0400
I don't believe that the subject matter should be moderated
but I approve of encouraging kindness in verbal conduct.
Anybody can tell when a person is being unkind. Please speak
to me as you would have me speak to you. In the event that
somebody violates the group's decorum, there should be no
thought of punishment, revenge, or harsh criticism. Being kind
to your friends is good. Being kind to your detractors (without
sarcasm) sets the issue straight while also setting a good example.
Stern messages might be written about an issue, but should not be
written to make somebody feel bad. If you can get passed your
anger, your kindness will be much more effective in correcting silly
behavior than behavior of the same sort.
The trappings of course messages are not the issue. I don't like
vulgar words and I don't recommend them; but, it is the lack of
sincere concern for people which is the real stuff of our emotional
plague. Some of us have been hurt so badly by the world that the
words used in messages to others are not even recognized as hostile
when they are written. Only the kindness of others can heal such
an injury.
I recommend that the focus of any conduct policy be kindness
and not merely the cues of hostility.
Very sincerely,
Jim Trek
Future Beacon Technology
http://eznet.net/~progress
[EMAIL PROTECTED]
------------------------------
From: Tim Tyler <[EMAIL PROTECTED]>
Subject: Re: 1-time pad is not secure...
Reply-To: [EMAIL PROTECTED]
Date: Mon, 14 Aug 2000 23:17:07 GMT
[EMAIL PROTECTED] wrote:
: "Douglas A. Gwyn" <[EMAIL PROTECTED]> wrote:
:> [EMAIL PROTECTED] wrote:
:> > For example, one day we'll move on to nanocomputers, then current
:> > RNGs will not be random any more.
:>
:> Sure they will. What grounds do you have for saying otherwise?
: If your RNG is based on a huge cycle. Gone.
: If your proof has the word NP or polynomial-time in it. Gone.
Now you seem to be thinking about PRNGs - not the RNGs you mentioned.
I /suspect/ some quantum-computation/nano-computation confusion,
and some confusion about which operations these might make easier...
:> > Another side note: How come nobody has brought up anti-matters yet?
:> > It's so cool. :) Light -- photon -- is an anti-matter. Our
:> > understanding on antimatters is at the beginning stage. Maybe be
:> > some antimatters can travel faster then others. And then some smart
:> > kids, probably genetically-engineered, will show that antimatters
:> > have sub-antimatters...
:>
:> That does not correspond to "antimatter" as understood by physicists.
: You sure? I thought photon was considered an antimatter. [...]
No - photons are ordinary matter. You /can/ have anti-matter photons
in the same way as with other particles. The rest of the paragraph
does square with "antimatter" as understood by physicists either.
Probably, nobody else has brought up anti-matter yet because it appears to
have no relevance to the issues being discussed.
--
__________ Lotus Artificial Life http://alife.co.uk/ [EMAIL PROTECTED]
|im |yler The Mandala Centre http://mandala.co.uk/ Namaste.
------------------------------
From: Tim Tyler <[EMAIL PROTECTED]>
Subject: Re: 1-time pad is not secure...
Reply-To: [EMAIL PROTECTED]
Date: Mon, 14 Aug 2000 23:41:18 GMT
[EMAIL PROTECTED] wrote:
: If, for any reason, [...] the key generation process is biased, OTP is
: the LEAST secure (among those used) because of the huge key. No one
: seems to deny that!
It's highly suspect:
Large keys => more entropy => bigger keyspace for an attacker to
wade through. This is normally desirable.
If you argue that large keys => more scope for cryptanalysts to crack
regularities in the key generator, you /may/ have a point if the generator
is *very* badly broken - and only information from a single key is
available. This isn't likely to outweigh the first factor very often.
: With OTP, you can try it on the ciphertext at different locations.
: You'll get meaningful plaintext if it's in ascii. If not, you'll have
: to do more work, but it still gives you an advantage over pure
: guessing. See that's another problem with OTP. The verification process
: is too simple!
You want to make decrypting a more time-consuming process for the
legitimate recipient - in order to hinder attackers who want to
perform multiple decrypts?
I think one way to do this with a OTP is to stop using XOR and
start using a large permuting combiner instead. I doubt making
decrypting more painful for all parties involved is frequently
considered desirable.
--
__________ Lotus Artificial Life http://alife.co.uk/ [EMAIL PROTECTED]
|im |yler The Mandala Centre http://mandala.co.uk/ Namaste.
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
