Cryptography-Digest Digest #470, Volume #12 Thu, 17 Aug 00 19:13:01 EDT
Contents:
Re: blowfish problem (Gergo Barany)
Re: books (Ernest Dumenigo)
Re: 1-time pad is not secure... (Darren New)
Re: blowfish problem ("Michael Will")
Re: OT (Proposal of drafting rules of conduct of posting) (Mok-Kong Shen)
Re: Broadcast key Management (Jayant Shukla)
Re: blowfish problem ("Douglas A. Gwyn")
Re: DES: Say it or spell it? (Newbie question) ("Douglas A. Gwyn")
Re: blowfish problem (Gergo Barany)
Re: blowfish problem (Gergo Barany)
Re: 1-time pad is not secure... (Tim Tyler)
Re: DES: Say it or spell it? (Newbie question) (S. T. L.)
Re: Funny Observation (Tim Tyler)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (Gergo Barany)
Crossposted-To: comp.lang.c
Subject: Re: blowfish problem
Date: 17 Aug 2000 20:12:38 GMT
Daniel Leonard <[EMAIL PROTECTED]> wrote:
> I do not want to be rude, but there are some "errors" in your code.
I do not want to be rude, but your news software posts in some
funky "Quoted-Printable" encoding. It makes your posts hard to read
because it replaces many characters such as '=' with a code like
"=<hex>", where <hex> is a character's ASCII code in hexadecimal.
This stinks, please turn it off.
> On 17 Aug 2000, John Hascall wrote:
> > =09out =3D malloc(inLen * 2 + 1);
>
> shouldn't it be:
> out =3D malloc((inLen * 2 + 1) * sizeof(char));
> /* a char could be more than 1 byte */
No, a char is always one byte in C.
> > int hexDigit (
> > =09int=09fourBits
>
> and here, shouldn't it be:
> char hexdigit (
> char fourBits
> /* we use chars, we stay with chars */
If the poster of the code wants to use this broken algorithm, he
should probably use unsigned chars for fiddling with single bytes.
Otherwise, he should use printf() or a lookup table; see below.
> > ) {
> > =09fourBits &=3D 0x0f;=09=09=09=09/* safety first */
> >=20
> > =09return (fourBits < 10) ? (fourBits + '0') : (fourBits - 10 + 'a');
> > }
Since you value portability highly, you should have jumped on this.
It relies on the assumption that the characters of the alphabet are
contiguous and in an ascending order in the execution character set.
This is not guaranteed by the standard, and by far not all C
programs run on ASCII machines.
Maybe something like this would be better:
char *hexits = "0123456789abcdef";
unsigned char hexdigit(unsigned char fourBits)
{
fourBits &= 0xf;
return hexits[fourBits];
}
Gergo
--
Organic chemistry is the chemistry of carbon compounds. Biochemistry
is the study of carbon compounds that crawl.
-- Mike Adams
------------------------------
From: [EMAIL PROTECTED] (Ernest Dumenigo)
Subject: Re: books
Date: 17 Aug 2000 20:12:25 GMT
John A. Malley ([EMAIL PROTECTED]) wrote:
: Might I suggest
: "Cryptography, Theory and Practice" by Douglas R. Stinson,
: "Decrypted Secrets, Methods and Maxims of Cryptology" by F.L. Bauer,
: "Cryptanalysis, A Study of Ciphers and Their Solution" by Helen Fouche
: Gaines,
: "Applied Cryptography, Protocols Algorithms and Source Code in C" by
: Bruce Schneier,
: and either "Military Cryptanalysis Parts I, II, III and IV" by William
: F. Friedman
: or
: "Military Cryptanalytics, Part I, Vol. 1 and 2, and Part II, Vol. 1 and
: 2 " by
: William F. Friedman and L.D. Callimahos
: as a good start.
: (IMHO everything on cryptology from Aegean Park Press is worth reading,
: not just those last two entries in the list.)
: Any of these books are available from Barnes and Noble (bn.com) or
: Amazon.com.
: Aegean Park Press has its own web site at http://www.aegeanparkpress.com
: John A. Malley
: [EMAIL PROTECTED]
Thanks for the suggestions :-)
--
=====
Ernest
------------------------------
From: Darren New <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Subject: Re: 1-time pad is not secure...
Date: Thu, 17 Aug 2000 21:09:37 GMT
Tim Tyler wrote:
> If following a MWI, there are many "me"s and many "post"s. All have
> equal rights and status. By saying "this" post, you haven't uniquely
> identified anything, since there are many posts which are all claiming
> to be "this" post.
To be less silly (and to add something that should have been in the previous
post), if there's nothing random about MWI, what determines which
conciousness sees which pattern of random bits? Since the parallel worlds
cannot interact with each other once "collapsed", making a 2-bit random pad
gives you four worlds which do not communicate. Which one are "you" on, when
you look at the pad? Saying "all of them" doesn't help, because then you've
not only eliminated "random", you've eliminated "unpredictable", and since
everything now is predictable, you have eliminated "secret". Since there is
*always* a world in which you will try the correct key on the first try, how
do you do cryptography if you look at the world that way?
--
Darren New / Senior MTS & Free Radical / Invisible Worlds Inc.
San Diego, CA, USA (PST). Cryptokeys on demand.
"Do not install air conditioner in room with
inconvenient or hypnotic persons."
------------------------------
From: "Michael Will" <[EMAIL PROTECTED]>
Crossposted-To: comp.lang.c
Subject: Re: blowfish problem
Date: Thu, 17 Aug 2000 17:23:28 -0400
Gergo Barany wrote:
>Daniel Leonard <[EMAIL PROTECTED]> wrote:
>> On 17 Aug 2000, John Hascall wrote:
>> > =09out =3D malloc(inLen * 2 + 1);
>>
>> shouldn't it be:
>> out =3D malloc((inLen * 2 + 1) * sizeof(char));
>> /* a char could be more than 1 byte */
7.8: I see code like
char *p = malloc(strlen(s) + 1);
strcpy(p, s);
Shouldn't that be malloc((strlen(s) + 1) * sizeof(char))?
A: It's never necessary to multiply by sizeof(char), since
sizeof(char) is, by definition, exactly 1. (On the other hand,
multiplying by sizeof(char) doesn't hurt, and in some
circumstances may help by introducing a size_t into the
expression.) See also question 8.9.
References: ANSI Sec. 3.3.3.4; ISO Sec. 6.3.3.4; H&S Sec. 7.5.2
p. 195.
>No, a char is always one byte in C.
No, sizeof(char) is always 1 in C.
These are not two ways of saying the same thing. A char can be wider
than 8 bits, but even then sizeof(char) == 1 by definition. It may
seem strange at first, but it is true.
- Michael
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: OT (Proposal of drafting rules of conduct of posting)
Date: Fri, 18 Aug 2000 00:19:59 +0200
Paul Pires wrote:
>
> Mok-Kong Shen <[EMAIL PROTECTED]> wrote
> >
> > Paul Pires wrote:
> > >
> > > Mok-Kong Shen <[EMAIL PROTECTED]> wrote
> > >
> > > > It was my opinion that you were extending the scope of
> > > > the argumentation, thus leading to view points regarding
> > > > cultural mindsets etc.
> > >
> > > Too bad you didn't say that. Note the OT label I put on it.
> >
> > Sorry, that acronym was not known to me and I had certainly
> > ignored that.
> >
> > > >My proposal was more practical
> > > > oriented and (very) limited to the issue here, being
> > > > motivated by complains about rude sytle and that of
> > > > tomstd.
> > >
> > > I didn't complain about Toms style, I objected to it directly and called
> him
> > > on it. The process was working.
> >
> > You apparently misunderstood. I was referring to the content
> > of tomstd's post. There was no implication about his style.
>
> You say potaaato, I say patahhhhto....
>
> What's the conclusion to the verse?
>
> A: Let's call the whole thing off.
We should certainly terminate our discussion. But it is
my understanding that the above could lead to some
non-trivial misunderstanding by others, namely it could
be understood to mean that we were both attempting to
criticize on 'Tom's behaviour' in this thread. I want
to say that I haven't done that and there has never
been any intention in this direction from the very
beginning, because my propsal is absolutely neutral.
(I don't exclude that you parsed my sentence in a
different way. My 'complains about rude sytle and that
of tomstd' means 'complains about rude style and
complains of (from) tomstd'!). In fact, the invisaged
rules could hit myself as well, eventually heavily,
if e.g. I am not careful enough in writing my posts
in the future. Sorry that I write nonetheless
something but this is intended for other readers, not
for you. Anyway I want to apologize to tomstd for
non-willingly having caused his name to be involved
in discussions of the present thread under improper
context.
M. K. Shen
------------------------------
From: [EMAIL PROTECTED] (Jayant Shukla)
Subject: Re: Broadcast key Management
Date: 17 Aug 2000 21:42:52 GMT
Antonio Romeo <[EMAIL PROTECTED]> writes:
>I need some informations about the key management for broadcast
>applications and systems.
Do you mean multicast? Broadcast means it is for everyone
and you do not need to keep it secret.
Take a look at this internet draft at the IETF home page.
draft-ietf-ipsec-gkmframework-03.txt
other RFCs to look at are 1949 and 2113.
regards,
Jayant
>thanks in advance.
>--
>Antonio ROMEO
>=========================================
>Swiss Federal Institute of Technology
>Department of Electrical Engineering
>Integrated Systems Laboratory (ISL)
>EPFL-DE-LSI ELB-Ecublens
>CH-1015 Lausanne
>tel. +41 21 693 69 79
>fax +41 21 693 46 63
>email [EMAIL PROTECTED]
>http://lsiwww.epfl.ch
>==========================================
------------------------------
Crossposted-To: comp.lang.c
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: blowfish problem
Date: Thu, 17 Aug 2000 21:26:03 GMT
Daniel Leonard wrote:
> shouldn't it be:
> out = malloc((inLen * 2 + 1) * sizeof(char));
> /* a char could be more than 1 byte */
No; the C standard requires that sizeof(char)==1. However,
there can be more than 8 bits in a byte; the CHAR_BIT macro
defined in <limits.h> says how many there actually are.
The real problem is that type "char" is not always suitable
for representing arbitrary characters. The standard type
for that is wchar_t, and there are associated I/O functions
etc. For use in encrypting general data, however, there is
no need to interpret the data as characters; it can be
treated as a file of uninterpreted bytes.
> > int hexDigit (
> > int fourBits
> and here, shouldn't it be:
> char hexdigit (
> char fourBits
> /* we use chars, we stay with chars */
No; because there was no prototype in scope when the function
was first encountered, it was assigned a prototype based on
the way it was used in context, *including* default widening
of its arguments and return value. And char widens to int.
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: DES: Say it or spell it? (Newbie question)
Date: Thu, 17 Aug 2000 21:29:30 GMT
DJohn37050 wrote:
> DES is usually pronounced dezz.
Since when? Everybody I know spells it out, just as we do
with the other umpteen thousand acronyms we are plagued with.
------------------------------
From: [EMAIL PROTECTED] (Gergo Barany)
Crossposted-To: comp.lang.c
Subject: Re: blowfish problem
Date: 17 Aug 2000 22:44:36 GMT
Michael Will <[EMAIL PROTECTED]> wrote:
> Gergo Barany wrote:
>
> >No, a char is always one byte in C.
>
> No, sizeof(char) is always 1 in C.
>
> These are not two ways of saying the same thing.
Actually, they are. This topic has been beaten almost to death
several times in comp.lang.c, but since sci.crypt is watching, I'll
kick it a little more when it's down.
> A char can be wider
> than 8 bits, but even then sizeof(char) == 1 by definition. It may
> seem strange at first, but it is true.
It does not seem strange to me, and I completely agree. I know that
the terms "byte" and "octet" are not the same. I think we both agree
that an octet is a group of 8 bits; a byte, however, is something
else. The N869 draft standard (available from
http://anubis.dkuug.dk/JTC1/SC22/WG14/www/docs/n869/ and AFAIK
identical in its normative contents to the actual standard) has
these things to say:
3. Terms and definitions
3.4
[#1] byte
addressable unit of data storage large enough to hold any
member of the basic character set of the execution
environment
3.5
[#1] character
bit representation that fits in a byte
So, a char fits into a byte.
5.2.4.2.1 Sizes of integer types <limits.h>
[#1] The values given below shall be replaced by constant
promotions. [...] Their implementation-defined values shall be
equal or greater in magnitude (absolute value) to those
shown, with the same sign.
-- number of bits for smallest object that is not a bit-
field (byte)
CHAR_BIT 8
-- maximum value for an object of type unsigned char
UCHAR_MAX 255 // 28**-1
A char must be at least 8 bits. *At least*. It can be more. And
since a char must fit into a byte, a byte can be more than 8 bits
long. QED. If that doesn't make you happy, try this proof:
6.5.3.4 The sizeof operator
[#2] The sizeof operator yields the size (in bytes) of its
operand, which may be an expression or the parenthesized
name of a type.
[#3] When applied to an operand that has type char, unsigned
char, or signed char, (or a qualified version thereof) the
result is 1.
sizeof(char) is 1. sizeof returns its operand's size in bytes.
Therefore a char is one byte long. QED.
And to show that this is not just crazy C programmers talking, see
this (admittedly non-normative) quote from the Jargon File:
byte /bi:t/ n.
[techspeak] A unit of memory or data equal to the amount used to
represent one character;
(It also says that this is usually, but not always, an octet.)
Gergo
--
In this vale
Of toil and sin
Your head grows bald
But not your chin.
-- Burma Shave
------------------------------
From: [EMAIL PROTECTED] (Gergo Barany)
Crossposted-To: comp.lang.c
Subject: Re: blowfish problem
Date: 17 Aug 2000 22:49:38 GMT
Gergo Barany <[EMAIL PROTECTED]> wrote:
>
> -- maximum value for an object of type unsigned char
> UCHAR_MAX 255 // 28**-1
^^^^^^
Oops. Plain-text N869 uses "28-1" as the comment, and I inserted the
exponentiation at the wrong place. The above should be "2**8-1".
Gergo
--
If our behavior is strict, we do not need fun!
------------------------------
From: Tim Tyler <[EMAIL PROTECTED]>
Subject: Re: 1-time pad is not secure...
Reply-To: [EMAIL PROTECTED]
Date: Thu, 17 Aug 2000 22:37:43 GMT
Tony T. Warnock <[EMAIL PROTECTED]> wrote:
: Tim Tyler wrote:
:> Mark T. VandeWettering <[EMAIL PROTECTED]> wrote:
:> : In article <[EMAIL PROTECTED]>, Tim Tyler <[EMAIL PROTECTED]> wrote:
:> :>Any process that appears random may be the deterministic outcome of events
:> :>at a lower level. The rational scientist can't currently say one way or
:> :>the other about whether there is determinism in physics - he plain doesn't
:> :>know.
:>
:> : Quantum mechanics addresses this issue. It disagrees with you. Please
:> : post your refutation of quantum mechanics [...]
:>
:> Quantum mechanics does not address the issue - to do so it would have to
:> claim to be a final theory of physics [...]
:> I don't "disagree" with quantum mechanics - unless it is presented as the
:> final theory of the universe - which it is /extremely/ unlikely to be.
: QM may not be the final theory of the universe, but other theories will
: have to explain the results of QM.
Clearly.
: The randomness in QM is different from the randomness we assign to dice
: throwing. Whether a coin comes up heads or tails or a die shows a 1 or 2
: can be computed in principle from inital conditions and the laws of motion.
: It turns out that averaging over initial conditions gives a uniform
: distribution on the outcomes. QM is different. Whether an atom decays
: at a certain time is a random event, there are no initial conditions
: to average over.
This boils down to a simple assertion of randomness. You *claim* that
"whether an atom decays at a certain time is a random event", and use this
to to conclude that fundamental physical randomness exists.
This begs the question - all I have to do is doubt your premise.
You don't have any basis for the claim that there are no initial
conditions. What you have is ignorance of any relevant initial
conditions. This is not necessarily the same thing.
...
A significant issue with quantum physics is not so much whether events
are caused by fundamentally random fluctuations, but whether *if* they
are caused by non-random events, an embodied observer can ever learn
enough about these to make useful predictions based on them.
Heisenberg's principle suggests that this might be rather difficult
to do.
However, this all seems rather a long way from OTPs. Without a good
method getting macroscopic measured events from quantum phenomena, in
the face of opposition from ones' opponents, discussion of quantum
theory seems rather irrelevant.
--
__________ Lotus Artificial Life http://alife.co.uk/ [EMAIL PROTECTED]
|im |yler The Mandala Centre http://mandala.co.uk/ Namaste.
------------------------------
From: [EMAIL PROTECTED] (S. T. L.)
Subject: Re: DES: Say it or spell it? (Newbie question)
Date: 17 Aug 2000 23:00:02 GMT
I have always said "DES" as three letters, but "IDEA" as a single word.
-*---*-------
S.T.L. My Quotes Page * http://quote.cjb.net * leads to my NEW site.
My upgraded Book Reviews Page: * http://sciencebook.cjb.net *
Optimized pngcrush executable now on my Download page!
Long live pngcrush! :->
------------------------------
From: Tim Tyler <[EMAIL PROTECTED]>
Subject: Re: Funny Observation
Reply-To: [EMAIL PROTECTED]
Date: Thu, 17 Aug 2000 22:51:26 GMT
[EMAIL PROTECTED] wrote:
:> On Wed, 16 Aug 2000 20:02:06 GMT, [EMAIL PROTECTED] wrote, in part:
:> >Anyone ever notice that Dave Scott calls himself the 'Zip Guy' but
:> >known of his software involves the deflate algorithm.
I believe he has, in fact, used zip compression, for some things.
: I can't fathom why he believes huffman or arith alone is better then
: deflate. I really would like to see him find typical files that
: compress better with his methods then deflate.
Files that compresses better with Huffman or arithmetic compression alone
exist. It's known that any compressor that doesn't add information which
isn't present in the original file is optimal for /some/ set of target
files.
I beleive for Huffman/arithmetic schemes, the criterion is something
vaguely along the lines of a fixed frequency of symbols throughout
individual target files. In addition, hHffman schemes prefer it if
these frequencies are exact multiples of two of one another.
: Also time and time again I repeat that smaller files means less WASTED
: SPACE. Which means the entropy per bit is higher (closer to one) then
: with the other methods. Doesn't that make sense?
This is true. What is your point?
While size is important, the size of the resulting files is not the only
criterion when choosing a compression algorithm for use with encryption.
--
__________ Lotus Artificial Life http://alife.co.uk/ [EMAIL PROTECTED]
|im |yler The Mandala Centre http://mandala.co.uk/ Namaste.
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
