Cryptography-Digest Digest #527, Volume #12 Thu, 24 Aug 00 15:13:01 EDT
Contents:
Re: Apart from Generation...? (Mike Rosing)
Excerpt of SECRETS AND LIES available on-line (Bruce Schneier)
Re: Serious PGP v5 & v6 bug! ("Michel Bouissou")
Re: Bytes, octets, chars, and characters (Shez)
Re: Sending Messages in Morse Code (Terry Ritter)
Re: Serious PGP v5 & v6 bug! ("Howard")
Re: Serious PGP v5 & v6 bug! ("Howard")
Re: Serious PGP v5 & v6 bug! (Mok-Kong Shen)
Re: Bytes, octets, chars, and characters ([EMAIL PROTECTED])
How can I work out how many 'bit' my program encrypts files at?? ("William T")
Re: Provably secure stream cipher (Mok-Kong Shen)
Re: Steganography vs. Security through Obscurity (Gisle
=?iso-8859-1?Q?S=E6lensminde?=)
Re: Serious PGP v5 & v6 bug! (Keith)
Re: Serious PGP v5 & v6 bug! (Keith)
Re: Provably secure stream cipher ([EMAIL PROTECTED])
Reply now to join the crypto-research-ressources group ([EMAIL PROTECTED])
Re: Serious PGP v5 & v6 bug! ([EMAIL PROTECTED])
Re: The DeCSS ruling (Mark Wooding)
----------------------------------------------------------------------------
From: Mike Rosing <[EMAIL PROTECTED]>
Subject: Re: Apart from Generation...?
Date: Thu, 24 Aug 2000 11:55:14 -0500
Sergio Arrojo wrote:
>
> I am aware that making software capable of
> generating elliptic curves in a reasonable amount of time is a difficult
> stuff. But tell me, is it really so difficult to make ECDSA, encryption,
> decryption and key exchange software once you have an appropiate curve?. I
> mean, it seems to me that the strong mathematics are involved on generating
> the curve, and that most of the implementations are really just operations
> with
> big numbers. Am I misssing something here?
> Do you thing we could find specific software for less price that would not
> include the generation of curves?
The software for implementing ECC is free and available on the web in many
places. Point counting software is available from Michael Scott if you
want to use MIRACL. So you can do everything you want with free code!
Patience, persistence, truth,
Dr. mike
------------------------------
From: Bruce Schneier <[EMAIL PROTECTED]>
Subject: Excerpt of SECRETS AND LIES available on-line
Date: Thu, 24 Aug 2000 12:00:15 -0500
A couple of weeks ago, someone asked about on-line distribution of my
latest book. I just noticed that Chapter 3 is up on Amazon:
http://www.amazon.com/exec/obidos/ts/book-excerpt/0471253111/ref=pm_dp_ln_b_3/103-9091257-0055007
Not the chapter I would have picked to excerpt, but no one asked me.
A couple of weeks ago I also warned people that Amazon was no longer
offering the 30% discount, only a 20% discount. You can get a 30%
discount on FatBrain, which is the cheapest I've seen for the book:
http://www1.fatbrain.com/asp/bookinfo/bookinfo.asp?theisbn=0471253111
As always, information about the book can be found at:
http://www.counterpane.com/sandl.html
Cheers,
Bruce
**********************************************************************
Bruce Schneier, Counterpane Internet Security, Inc. Tel: 408-556-2401
3031 Tisch Way, Suite 100PE, San Jose, CA 95128 Fax: 408-556-0889
Free crypto newsletter. See: http://www.counterpane.com
------------------------------
From: "Michel Bouissou" <[EMAIL PROTECTED]>
Crossposted-To: alt.security.pgp,comp.security.pgp.discuss
Subject: Re: Serious PGP v5 & v6 bug!
Date: Thu, 24 Aug 2000 19:08:51 +0200
JL <[EMAIL PROTECTED]> a �crit dans le message :
ficp5.5082$[EMAIL PROTECTED]
>
> > Still worse, being able to read the message probably means that the
attacker
> > was able to intercept your e-mail. If the attacker is able of a true
MITM
> > attack, he can remove the message (that he was able to decrypt) and
> > re-encrypt it to a genuine copy of your key, so you will receive the
> > original message encrypted to your key only, and have no way to directly
> > discover the manipulation. Only, of course, that the such re-encrypted
> > message could not be PGP-signed by the sender.
>
> An invalid signature would be enough to warn you, and this would therefore
not
> be a successfull MITM attack.
An invalid signature, yes. No signature at all, not necessarily. One doesn't
always sign the messages she encrypts...
> > I'm not myself expert in the PGP packet structure (and so request expert
> > advice), but could it be possible that the MITM attacker gets the
message,
> > and then only removes the packets corresponding to the additional ADK
> > encryption before forwarding the message to its intented recipient, thus
> > keeping the signature intact and making the interception unnoticeable to
the
> > recipient?
>
> Hum... I hadn't thought of that. It all has to do with whether the message
is
> signed before or after encryption. From what I understand from RFC 2440
the
> message is signed BEFORE encryption,
Yes, that's what it does, unless you use a "clearsig" option AFAIK...
> and that would seem logical since it
> enables only the recipient to check the signature:
>
> First, a signature is generated for the message and
> attached to the message. Then, the message plus signature is
> encrypted using a symmetric session key. Finally, the session key is
> encrypted using public-key encryption and prefixed to the encrypted
> block.
>
> It is therefore very possible for a MITM attacker to remove the ADK
packets
> unoticed. This bug is much more devastating than I originally thought.
This is exactly what I feared....
> The only workaround is to manually sign your message AFTER encryption, so
that
> the recipient can check the packets haven't been tampered with.
Usual e-mail software plug-ins are not designed for that, and it thus
necessitates to be a manual operation.
Furthermore, this solution necessitates that both sender and recipient
previously agreed on such a protocol. This means very aware and careful
users, and in such a situation the sender would probably not have missed the
ADK encryption in the first place...
> > For all these reasons, and if this "bug" is confirmed, the only
reasonable
> > and secure choice would be to immediately quit using any key format or
> > software that might allow an attacker to append its own ADK to one's
public
> > key.
> >
> > Which unfortunately means quit using any PGPv5 or PGPv6 DH/DSS keys, or
> > PGPv5 or PGPv6 created RSA keys.
>
> That wouldn't be a solution at all, since you don't have control over
which
> software the sender uses to send encrypted messsages to you. Even if you
use
> GPG, the sender could still use PGP 6.x.
Yes, but No.
Because if you use GPG or PGP 2.6.3 with RSA only, you won't generate a
v4-self-signature on your public key, and then your public key will offer no
place to hide a forged ADK, as this one can reside only in a
v4-self-signature block according to Ralf's report.
So, indeed, it would work.
--
Michel Bouissou <[EMAIL PROTECTED]> PGP DH/DSS ID 0x5C2BEE8F
------------------------------
From: Shez <[EMAIL PROTECTED]>
Crossposted-To: comp.lang.c,alt.folklore.computers
Subject: Re: Bytes, octets, chars, and characters
Date: Thu, 24 Aug 2000 04:56:15 +0100
Reply-To: Shez <[EMAIL PROTECTED]>
Eric Smith <[EMAIL PROTECTED]> writes:
>> BTW, I never understood how they were allowed to publish a paper on
>> Harvest, given who their customer was.
>
>And the reference manual!
>
>I'm told that there was some debate at the time as to whether the material
>should be published, and apparently the decision was that there was no
>particularly sensitive material in the documentation. The examples in
>the manual describe such sensitive operations as converting to roman
>numerals.
I recall stories in the computer press c.1980 which talked about the
NSA's offshore (UK) base which had just been unmasked, and they referred
to an IBM machine with a "Harvest Overdrive" which was described as a
64bit device for cracking DES codes. (I was under the impression that
they had more than one of these beasts though.)
It's kind of funny how journalists have been "discovering" essentially
the same story about the NSA's activities at roughly five year intervals
ever since....
--
______________________________________________________
Dangerous exercise: Jumping to conclusions.
______________________________________________________
------------------------------
From: [EMAIL PROTECTED] (Terry Ritter)
Crossposted-To: sci.math
Subject: Re: Sending Messages in Morse Code
Date: Thu, 24 Aug 2000 17:35:53 GMT
On Thu, 03 Aug 2000 14:32:43 GMT, in <[EMAIL PROTECTED]>,
in sci.crypt [EMAIL PROTECTED] (John Savard) wrote:
>[...]
>I had been looking for a reference that named whoever was responsible
>for "Continental Morse", but could never find one! Thank you for
>supplying this little tidbit of information...now, Morse joins
>Uedemann and Baudot, as pioneering inventors, and Gerke joins
>Gringmuth and Murray as those whose modifications bear the names of
>the original inventors.
You also might want to look at:
http://www.joates.demon.co.uk/megs/N0HFF/c19a.htm
which says Alfred Vail was the primary inventor of Morse code.
---
Terry Ritter [EMAIL PROTECTED] http://www.io.com/~ritter/
Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
------------------------------
From: "Howard" <[EMAIL PROTECTED]>
Crossposted-To: alt.security.pgp,comp.security.pgp.discuss
Subject: Re: Serious PGP v5 & v6 bug!
Date: Thu, 24 Aug 2000 18:31:12 +0100
=====BEGIN PGP SIGNED MESSAGE=====
"Michel Bouissou" <[EMAIL PROTECTED]> wrote in message
news:8o3jrh$kjj$[EMAIL PROTECTED]...
: No, I don't think so. There are 3 ways that you can detect that an ADK is
: out there:
<snip>
Thanks for that Michel. Excellent explanation of the issues.
I consider that I'm a relatively competent user, and only exchange
encrypted mail with a small number of people. As none of their keys show
any indication of ADKs, I'll advise them to check mine and continue as
before, instituting careful checks should I, (or anyone I know) have to
download keys in future from public servers.
Thanks again
- --
Howard
PGP Keys:
0xECFEF05F (DH/DSS)
0x96302AD7 (RSA)
=====BEGIN PGP SIGNATURE=====
Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com>
iQEVAwUBOaVb3Pex36KWMCrXAQEK/Qf/df5lD4tlMrK6k+H8aNg9YTDt0DgQw9ga
NwKODEF6lfeuE4GdyjbWjY2BvFYjacZ+tkSjKEnsBsa4CvUeJVEo2fVhkL4YH7Mt
e+bEL+r6wxu9ZLRj1BmSnyb7fhpva7LIsCyokN5IE0n0W4zY8xjh7O6aLCZNaT19
E5czKruvULjD663fGYi+81odP4vBry+REd1NyEAq4Krwly7Jqx3OttsMUhRIjY9C
+ERhhmw5al2Fw1xP84JdLtYEdvjhSXhCUK6qqeu2pVvx5zRM3NN4zDjBTl2aeP4P
/DWDX4kqusLI97PeAKTjeB93qPeiaG90GVJaVBKY9/fHqdRCTDV1YQ==
=GAN+
=====END PGP SIGNATURE=====
------------------------------
From: "Howard" <[EMAIL PROTECTED]>
Crossposted-To: alt.security.pgp,comp.security.pgp.discuss
Subject: Re: Serious PGP v5 & v6 bug!
Date: Thu, 24 Aug 2000 18:32:54 +0100
=====BEGIN PGP SIGNED MESSAGE=====
"JL" <[EMAIL PROTECTED]> wrote in message
news:Hucp5.5085$[EMAIL PROTECTED]...
: "Howard" <[EMAIL PROTECTED]> a �crit dans le message news:
: Cnap5.687$[EMAIL PROTECTED]
:
: > My understanding of Ralf's paper is that the ADK is undetectable.
:
: That's not what I understand.
Yep, I think I'm across this now. Thanks a lot...
Howard.
PGP Keys:
0xECFEF05F (DH/DSS)
0x96302AD7 (RSA)
=====BEGIN PGP SIGNATURE=====
Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com>
iQEVAwUBOaVcQvex36KWMCrXAQHwhAgArjYnRzmYCtsuNQbZj6I/j8a8KpWp6Nuu
wABLq9vLqGyBE2oIUFm+TfLfY29XuIg4r/soCWtj8J62O1znfQL3P7HUg8HbVrar
Xddb7mUMAdjZuMoP6y6DmT7Ubw8B/1csqgZzvY7hhIBNKxvwhunXIi8CeiFTk9MP
L8YqwXmTdlkEhguytyqwUqr3yBsEZM//Y/SHTfxFtVyAHEVxZSikVEdp17eiLDYj
4O8D7GXVWP2oDUK82NcEsljskzoeSkgEsOVq1QCDzGTkFmUHffPHbaJZJrqSj5ea
5cTkac4kbDTSso36zcyjZo0+RrUGgFWoqS8++7zChm8BxkhIqjSNiw==
=sT6J
=====END PGP SIGNATURE=====
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Crossposted-To: alt.security.pgp,comp.security.pgp.discuss
Subject: Re: Serious PGP v5 & v6 bug!
Date: Thu, 24 Aug 2000 19:57:45 +0200
Runu Knips wrote:
>
> Mok-Kong Shen wrote:
> > This once again stresses the fact that one can't entirely
> > depend on stuffs from others being error-free, bug-free,
> > etc. etc. One has to do something oneself, if security is
> > really at stake.
>
> Sorry, but this statement is silly. One better depends upon
> something from the specialists than depending upon the own
> code. There is no error free code anyway, but one has a
> better chance for it if one uses something which got
> public review, such as PGP, GnuPG, OpenSSL etc.
Did I say one has to do everyting oneself? My point it
that it is dangerous to entirely rely on others, no
matter how big names these specialists or organisations
have.
M. K. Shen
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: Bytes, octets, chars, and characters
Date: Thu, 24 Aug 2000 17:52:04 GMT
In article <[EMAIL PROTECTED]>,
"Douglas A. Gwyn" <[EMAIL PROTECTED]> wrote:
> [EMAIL PROTECTED] wrote:
> > BTW, I never understood how they were allowed to publish a paper on
> > Harvest, given who their customer was.
>
> What country do you think this is, the Soviet Union?
> In the US, the government can constrain publication only
> under certain circumstances covered by the law, for
> example when it is reasonable to think that the nation's
> security would be jeapordized by the publication.
What century were you born in? Does the name joe mccarthy mean anything
to you? "tail gunner joe" was strikingly similar in his methods to that
other joe, although he lacked the power to do more than ruin the careers
of innocent people. The only reason that he was stopped was that he made
the political mistake of attacking the Army. The 1950s were not a decade
of openness.
--
--
Shmuel (Seymour J.) Metz
"A BIND is a terrible thing to waste"
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: "William T" <[EMAIL PROTECTED]>
Subject: How can I work out how many 'bit' my program encrypts files at??
Date: Thu, 24 Aug 2000 19:00:49 +0100
In my program I use RC4 to encrypt files (check it out, online version as
well using ActiveX @ http://www.tracz.freeserve.co.uk or
http://members.xoom.com/wtracz/ ) but have been asked by many of the users
how strong the algorithm is. Am I right in saying that RC4 is a variable bit
stream cipher as the strength relies on the size of the key being used? If
what i am saying is incorrect can you please tell me what i should say.
WT
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: Provably secure stream cipher
Date: Thu, 24 Aug 2000 20:33:13 +0200
[EMAIL PROTECTED] wrote:
> Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
> > [EMAIL PROTECTED] wrote:
> > >
> > > Here is an idea for a somewhat slow provably secure (as long as the
> > > underlying prng is statistically random, but need not wholely
> random).
> > >
> > > Based (yet again) on the simple pair-wise decorrelated function
> > >
> > > f(x) = ax + b
> > >
> > > in GF(2^n) (n = 8, 32, 64 ...)
> > >
> > > The idea is that the prng will make the (a, b) values for each 'x'
> that
> > > is being encrypted. Since this is pairwise decorrelated and the
> values
> > > (a, b) are made anew with each output this is provably secure if the
> > > stream (a, b) is not guessable (in this case without any known
> stream).
> >
> > Could you please explain 'this' in the phrase 'this is
> > pairwise decorrelated'? Further, with the little that I
> > (presume to) know about decorrelation, 'decorrelated'
> > means a decorrelation (to some order) of zero. Which
> > value is zero in the present case? Thanks.
>
> Decorrelated to zero would be f(x) = x, which means knowledge of the
> input immediately yields the output.
>
> Decorrelated to one-wise would be f(x) = x + k, where it takes one pair
> of inputs and outputs to tell the function from random.
>
> Decorrelated to pair-wise would be f(x) = ax + b, where it takes two
> pairs (the inputs (0, 1) specifically) to find the values 'a' and 'b'.
> If I give you
>
> f(5) = 5a + b = 23 (mod 256), you have no way of knowing what 'a'
> or 'b' was. now if I give you f(4) = 19, you can solve it...
>
> The idea of the stream cipher is to use the pair 'a' and 'b' once per
> byte/word making it impossible to solve it. Thus requiring one to
> guess the prng state.
Whatever the new terminology is, if there are serial correlations
in the sequence f(x), then the cipher cannot be a perfect one,
and hence cannot be provably secure (unless one has some
'lower-quality' definition of 'secure') in my view. If the
PRNG is not perfect (hardly a practical PRNG is perfect),
the successive a's and b's will have correlations and these
would transfer in more or less degree to f(x). (If the PRNG
were perfect, one could have simply used it as an OTP).
M. K. Shen
------------------------------
From: [EMAIL PROTECTED] (Gisle =?iso-8859-1?Q?S=E6lensminde?=)
Subject: Re: Steganography vs. Security through Obscurity
Date: 24 Aug 2000 20:28:33 +0200
In article <8o31hu$8v5$[EMAIL PROTECTED]>, [EMAIL PROTECTED] wrote:
>In article <[EMAIL PROTECTED]>,
> "Douglas A. Gwyn" <[EMAIL PROTECTED]> wrote:
>
>> In fact there are steganographic systems that meet that
>> requirement -- even if the enemy is looking for your
>> message and knows how you're hiding it, he cannot prove
>> that it is present.
>
>Great! Can you list a reference?
Andrew McDonald and Markus Kuhn at Computer Laboratory of the University
of Cambridge have made a steganographic filesystem for Linux that they
claim to have this ability. The sourcecode and a paper describing the
theory behind it can be found at:
http://ban.joh.cam.ac.uk/~adm36/StegFS/
--
Gisle S�lensminde ( [EMAIL PROTECTED] )
With sufficient thrust, pigs fly just fine. However, this is not
necessarily a good idea. It is hard to be sure where they are going
to land, and it could be dangerous sitting under them as they fly
overhead. (from RFC 1925)
------------------------------
From: Keith <[EMAIL PROTECTED]>
Crossposted-To: alt.security.pgp,comp.security.pgp.discuss
Subject: Re: Serious PGP v5 & v6 bug!
Date: Thu, 24 Aug 2000 11:50:19 -0700
Reply-To: "Keith" <[EMAIL PROTECTED]>
On Thu, 24 Aug 2000 15:45:08 +0100, Sam Simpson
<[EMAIL PROTECTED]> wrote:
>So, specifically, this problem is only an issue if the sender is
>using an effected version of NAI PGP....Which just so happens to be
>most users!
Am I supposed to believe that NSA..., oops I mean NAI, and their programmers
are so stupid to overlook such a feature, I mean bug of course. They must have
been hanging out at the water cooler listening to Zimmermann tell his 3 year
horror story of being investigated by the US DOJ that when a nice man from
the government stopped by they took a keen interest in what he had to say.
Then not to long after PGP V6 the government lifts the export ban on PGP. I
don't know if they lifted the export ban on PGP 2.6.2, but if they did not
then that tells me something is very fishy.
--
Best Regards,
Keith
=============================================================================
Where do you discover free software for Windows? Strongsignals DOT COM is a
great place to start: http://Strongsignals.com "If a man hasn't discovered
something that he will die for, he isn't fit to live." --Martin Luther King, Jr
============================================================================
------------------------------
From: Keith <[EMAIL PROTECTED]>
Crossposted-To: alt.security.pgp,comp.security.pgp.discuss
Subject: Re: Serious PGP v5 & v6 bug!
Date: Thu, 24 Aug 2000 11:35:10 -0700
Reply-To: "Keith" <[EMAIL PROTECTED]>
On Thu, 24 Aug 2000 13:54:10 GMT, Ron B.
<[EMAIL PROTECTED]> wrote:
>This may not be a matter of personal trust. The company may see Jane
>as the perfect employee. If Jane is has a heart attack, has a fatal
>accident or for other reasons beyond her control is not available to
>decrypt important data, the company may have legitmate reasons to
>have access to her messages.
Then NAI/PGP should fucking make a product that is secure so people can do
that.
No wonder they can export PGP V5 and up, because of ADK a back door can be
built in later.
--
Best Regards,
Keith
=============================================================================
Where do you discover free software for Windows? Strongsignals DOT COM is a
great place to start: http://Strongsignals.com "If a man hasn't discovered
something that he will die for, he isn't fit to live." --Martin Luther King, Jr
============================================================================
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: Provably secure stream cipher
Date: Thu, 24 Aug 2000 18:55:02 GMT
In article <[EMAIL PROTECTED]>,
Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
>
>
> [EMAIL PROTECTED] wrote:
> > Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
> > > [EMAIL PROTECTED] wrote:
> > > >
> > > > Here is an idea for a somewhat slow provably secure (as long as
the
> > > > underlying prng is statistically random, but need not wholely
> > random).
> > > >
> > > > Based (yet again) on the simple pair-wise decorrelated function
> > > >
> > > > f(x) = ax + b
> > > >
> > > > in GF(2^n) (n = 8, 32, 64 ...)
> > > >
> > > > The idea is that the prng will make the (a, b) values for
each 'x'
> > that
> > > > is being encrypted. Since this is pairwise decorrelated and the
> > values
> > > > (a, b) are made anew with each output this is provably secure
if the
> > > > stream (a, b) is not guessable (in this case without any known
> > stream).
> > >
> > > Could you please explain 'this' in the phrase 'this is
> > > pairwise decorrelated'? Further, with the little that I
> > > (presume to) know about decorrelation, 'decorrelated'
> > > means a decorrelation (to some order) of zero. Which
> > > value is zero in the present case? Thanks.
> >
> > Decorrelated to zero would be f(x) = x, which means knowledge of the
> > input immediately yields the output.
> >
> > Decorrelated to one-wise would be f(x) = x + k, where it takes one
pair
> > of inputs and outputs to tell the function from random.
> >
> > Decorrelated to pair-wise would be f(x) = ax + b, where it takes two
> > pairs (the inputs (0, 1) specifically) to find the values 'a'
and 'b'.
> > If I give you
> >
> > f(5) = 5a + b = 23 (mod 256), you have no way of knowing what 'a'
> > or 'b' was. now if I give you f(4) = 19, you can solve it...
> >
> > The idea of the stream cipher is to use the pair 'a' and 'b' once
per
> > byte/word making it impossible to solve it. Thus requiring one to
> > guess the prng state.
>
> Whatever the new terminology is, if there are serial correlations
> in the sequence f(x), then the cipher cannot be a perfect one,
> and hence cannot be provably secure (unless one has some
> 'lower-quality' definition of 'secure') in my view. If the
> PRNG is not perfect (hardly a practical PRNG is perfect),
> the successive a's and b's will have correlations and these
> would transfer in more or less degree to f(x). (If the PRNG
> were perfect, one could have simply used it as an OTP).
That's why I said the security lies within the PRNG. You cannot attack
the mixing function f(x) without some knowledge of the internals of
it. Most PRNGS are sufficiently long perioded and statistically random
as to make attacking the stream cipher difficult.
Perhaps I should have stated that the "provable" part is on behalf of
the f(x) function not the entire stream cipher, sorry, that was a
mistake.
Tom
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: [EMAIL PROTECTED]
Subject: Reply now to join the crypto-research-ressources group
Date: Thu, 24 Aug 2000 18:53:37 GMT
Hello,
Reply to this email to join the crypto-research-ressources group,
an email group hosted by eGroups, a free, easy-to-use email group
service.
JOIN NOW, IT'S EASY: reply to this email by choosing "Reply" and then
"Send" in your email program.
By joining crypto-research-ressources, you will be able to exchange
messages with other group members. eGroups also makes it easy to store
photos and files, coordinate events and more.
Here's an introductory message from the group moderator:
========================================================================
Hi sci.crypt readers,
A new cryptography e-mail list in which you may be interested has been
created. Please feel welcomed to join!
Cryptoanimal
[EMAIL PROTECTED] moderator
[EMAIL PROTECTED]
========================================================================
TO JOIN THIS GROUP:
1) REPLY to this email by clicking "Reply" and then "Send"
in your email program
-OR-
2) Go to the eGroups site at
http://www.egroups.com/invite/crypto-research-ressources
and click the "JOIN" button
If you do not wish to join the crypto-research-ressources group, please
ignore this invitation.
SPECIAL NOTE FROM eGroups: Because eGroups values your privacy,
it is a violation of our service rules for moderators to abuse our
invitation service. If you feel this has happened, please notify us at
[EMAIL PROTECTED]
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
Crossposted-To: alt.security.pgp,comp.security.pgp.discuss
From: [EMAIL PROTECTED]
Subject: Re: Serious PGP v5 & v6 bug!
Date: Thu, 24 Aug 2000 18:52:09 GMT
=====BEGIN PGP SIGNED MESSAGE=====
Hash: SHA1
JL wrote:
> "Michel Bouissou" <[EMAIL PROTECTED]> a �crit dans le message news:
> 8o39ko$k97$[EMAIL PROTECTED]
> > For all these reasons, and if this "bug" is confirmed, the only reasonable
> > and secure choice would be to immediately quit using any key format or
> > software that might allow an attacker to append its own ADK to one's public
> > key.
> >
> > Which unfortunately means quit using any PGPv5 or PGPv6 DH/DSS keys, or
> > PGPv5 or PGPv6 created RSA keys.
>
> That wouldn't be a solution at all, since you don't have control over which
> software the sender uses to send encrypted messsages to you. Even if you use
> GPG, the sender could still use PGP 6.x.
> JL.
in case of GPG used one can make key which is not compatible with PGP
so sender also will have to use GPG
== <EOF> ==
Disastry http://i.am/disastry/
http://disastry.dhs.org/pgp.htm <-- PGP half-Plugin for Netscape
remove .NOSPAM.NET for email reply
=====BEGIN PGP SIGNATURE=====
Version: Netscape PGP half-Plugin 0.14 by Disastry / PGPsdk v1.7.1
iQA/AwUBOaVStTBaTVEuJQxkEQJFSwCgoCoW6HfngKQXXC3puJGkkmGiKOYAn1J0
TUrzDzzbbGK/bfbOyV/8eM0u
=dmRr
=====END PGP SIGNATURE=====
------------------------------
From: [EMAIL PROTECTED] (Mark Wooding)
Subject: Re: The DeCSS ruling
Date: 24 Aug 2000 15:18:43 GMT
Barry Adams <[EMAIL PROTECTED]> wrote:
> Quid custodes ipso custodian
I think you mean `Quis custodet ipsos custodes?' What you've written
makes no sense.
-- [mdw]
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
