Cryptography-Digest Digest #618, Volume #12 Tue, 5 Sep 00 20:13:01 EDT
Contents:
Re: Carnivore article in October CACM _Inside_Risks (Mok-Kong Shen)
Re: RSA Patent. (DJohn37050)
Re: Serpent S-boxes (again) (Jerry Coffin)
Re: RSA Patent. (wtshaw)
Re: RSA Patent. (Roger Schlafly)
trouble getting blowfish source to work ([EMAIL PROTECTED])
Re: RSA public exponent (Bryan Olson)
Re: Serpent S-boxes (again) ([EMAIL PROTECTED])
Re: 4x4 s-boxes ([EMAIL PROTECTED])
Blowfish Questions (Future Beacon)
Re: For those working on the next RSA factoring challenge... (JCA)
question on book selection (Ernest Dumenigo)
Re: Patent, Patent is a nightmare, all software patent shuld not be allowed (Bill
Unruh)
Re: RSA Patent. (Bill Unruh)
----------------------------------------------------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Crossposted-To: comp.security.misc,alt.security,talk.politics.crypto
Subject: Re: Carnivore article in October CACM _Inside_Risks
Date: Tue, 05 Sep 2000 22:32:36 +0200
Matt Blaze wrote:
>
[snip]
> You can find an advance copy at
> http://www.crypto.com/papers/carnivore-risks.html
It is entirely true that, as you said at the end of the
paper, it ultimately comes down to trust. At least three
different categories of persons could be involved in
the issue: those of government agencies, those of the
provider and those who clandestinely penetrate the
communication system. I am not sure that persons of any
one of these categories are without exception not only
morally entirely integral but also perform their work
without errors (which may not always be identifiable
afterwards). That software/hardware issues may pay a
role is in my humble opinion on the other hand of
comparatively secondary importance.
M. K. Shen
------------------------------
From: [EMAIL PROTECTED] (DJohn37050)
Date: 05 Sep 2000 20:35:16 GMT
Subject: Re: RSA Patent.
National security would be the rationale.
Don Johnson
------------------------------
From: Jerry Coffin <[EMAIL PROTECTED]>
Subject: Re: Serpent S-boxes (again)
Date: Tue, 5 Sep 2000 16:10:45 -0600
In article <[EMAIL PROTECTED]>, [EMAIL PROTECTED]
says...
[ ... ]
> I strongly believe that, for a crypto standard as important
> as AES, one should adopt the model very well practised by
> the programming language standard ADA.
Just FWIW, Ada is NOT an acronym -- it's named after Ada Lovelace, so
it's properly written with only the first letter capitalized (yet
another point it inherited from Pascal).
> The ADA language
> definition itself is very carefully done. There is further
> a document explaining the rationales of design. There is
> a standard committee ready to get input/questions from
> the public.
So far, this sounds an awful lot like nearly any programming language
with a standard approved by ANSI, ISO, etc.
> And there is at least one annual conference
> on the use of the language. Noting that ADA is only for
> covering part of the programming need (of course its
> authors would have liked it to be used for all applications,
> but this is not the point here), while AES is meant for
> 'universal' use, one easily sees the (in my humble opinion)
> fairly miserable state of affairs the users of a forthcoming
> crypto standard are in.
>
> To reinforce my previously stated conviction that a good
> crypto algorithm CAN (and SHOULD) be very well documented,
> I like to take this opportunity to cite in the following a
> well-known Austrian philosopher (my very poor translation;
> for original see the attachment below):
>
> 'What can be said at all can be clearly said;
> and one has to keep silence about what cannot
> be said.'
>
> It would be very deplorable, if one has ever to employ
> a cipher that has some features belonging to the second
> caterory delineated by the above citation.
In programming it's usually preferable for a standard to NOT keep
silent, but come right out and tell the reader about the boundaries
on what it's going to cover, and what it's not going to even try to
cover. It's true that some standards (e.g. Pascal's) have done poor
jobs of delineating between what they require and what they can
really only suggest, but with adequate delineation, it's certainly
useful to know what's desired, even when it's not absolutely
required.
--
Later,
Jerry.
The Universe is a figment of its own imagination.
------------------------------
From: [EMAIL PROTECTED] (wtshaw)
Subject: Re: RSA Patent.
Date: Tue, 05 Sep 2000 15:24:33 -0600
In article <[EMAIL PROTECTED]>, "Douglas A. Gwyn"
<[EMAIL PROTECTED]> wrote:
> Rich Wales wrote:
> > that the US gov't people who might otherwise have slapped a secrecy
> > order on the RSA algorithm realized there was no point in doing so?
>
> I am curious what the Constitutional basis for such an order might be.
The fiat that "We are the government, and can do any damned thing we want
to," usually is often accompanied with damnable things. Imagine an
executive order, bought and paid for that might do something even now
about it.
--
A Pangram(corrected, needed a G):
Vexed xenophobes fear crypto's jazzy, quaint workings.
------------------------------
From: Roger Schlafly <[EMAIL PROTECTED]>
Subject: Re: RSA Patent.
Date: Tue, 05 Sep 2000 16:05:11 -0700
"Douglas A. Gwyn" wrote:
> > that the US gov't people who might otherwise have slapped a secrecy
> > order on the RSA algorithm realized there was no point in doing so?
>
> I am curious what the Constitutional basis for such an order might be.
Unclear. Here is what a law review article says:
http://www.law.berkeley.edu/journals/btlj/articles/12_2/Lee/html/reader.html
Before exploring the potential constitutional violations under the First
and Fifth Amendments, it is useful to identify the Congress'
constitutional authority for invention secrecy. There are three
possibilities.
First, the Constitution empowers Congress to "provide for the common
Defense and general Welfare of the United States."210 Because invention
secrecy is primarily directed toward protecting the national security,
invention secrecy legislation is clearly authorized under this power.
Second, Congress has the power "[t]o promote the Progress of Science and
useful Arts, by securing for limited Times to Authors and Inventors the
exclusive Right to their respective Writings and Discoveries."211 This
provision, which authorizes the creation of a patent system, does not
grant inventors an absolute patent right. Rather, it gives Congress
extremely broad discretion to decide how the patent system should be
formulated. Invention secrecy can therefore simply be viewed as a
legitimate part of the patent system's operation.
Third, the power of eminent domain may authorize the government statute.
The Court has long recognized that the federal government may
constitutionally take private property,212 provided that the taking is
rationally related to a public purpose and just compensation is paid.213
Whether the imposition of a secrecy order meets these requirements is
the subject of the Takings Clause analysis below.214 If these
requirements are met, Congress' invention secrecy legislation can be
viewed as an appropriate exercise of the government's eminent domain
power.
------------------------------
From: [EMAIL PROTECTED]
Subject: trouble getting blowfish source to work
Date: Tue, 05 Sep 2000 23:19:40 GMT
I am having some trouble getting the blowfish
reference to work. I took the code from
counterpane's web site and wrote a wrapper that
runs it against the test vectors on the
counterpane website. I a bunch of failures. (See
below)
I am trying to use the reference code available on
http://www.counterpane.com/blowfish-
download.html. I am using the bfsh-sch.zip
source code. I have the little_endian define
turned on.
Following is the output of the test program I
wrote. The test program just runs through all
the test vectors and tests them. I am using
Visual C++ version 6.0 to compile it (with a
regular console project). What I have noticed is
that the tests that fail are the tests where the
key is a buffer such that if you reversed the
endianess of the first four bytes and the second
four bytes the value of the buffer wouldn't
change. (i.e. 1F1F1F1F0E0E0E0E works as a key,
but E0FEE0FEF1FEF1FE does not). There is one
exception to this however. It is in test number
3.
This suggests to me that there is some endian
problem somewhere, but reversing the endianess of
each dword in the key doesn't seem to help. And
there is the one exception in test number 3 noted
above. I got the test vectors from
http://www.counterpane.com/vectors2.txt.
Does any one have an idea why I am seeing this
failure?
Output from test program:
success! key: 0000000000000000 data: 00
success! key: FFFFFFFFFFFFFFFF data:
ffffffffffffffff
success! key: 3000000000000000 data: 100000001
success! key: 1111111111111111 data:
1111111111111111
failure! key: 0123456789ABCDEF data:
1111111111111111
success! key: 1111111111111111 data:
123456789abcdef
success! key: 0000000000000000 data: 00
failure! key: FEDCBA9876543210 data:
123456789abcdef
failure! key: 7CA110454A1A6E57 data:
1a1d6d039776742
failure! key: 0131D9619DC1376E data:
5cd54ca83def57da
failure! key: 07A1133E4A0B2686 data:
248d4386f67172
failure! key: 3849674C2602319E data:
51454b582ddf440a
failure! key: 04B915BA43FEB5B6 data:
42fd443059577fa2
failure! key: 0113B970FD34F2CE data:
59b5e0851cf143a
failure! key: 0170F175468FB5E6 data:
756d8e0774761d2
failure! key: 43297FAD38E373FE data:
762514b829bf486a
failure! key: 07A7137045DA2A16 data:
3bdd119049372802
failure! key: 04689104C2FD3B2F data:
26955f6835af609a
failure! key: 37D06BB516CB7546 data:
164d5e404f275232
failure! key: 1F08260D1AC2465E data:
6b056e18759f5cca
failure! key: 584023641ABA6176 data: 4bd6ef9176062
failure! key: 025816164629B007 data:
480d39006ee762f2
failure! key: 49793EBC79B3258F data:
437540c8698f3cfa
failure! key: 4FB05E1515AB73A7 data:
72d43a077075292
failure! key: 49E95D6D4CA229BF data:
2fe55778117f12a
failure! key: 018310DC409B26D6 data:
1d9d5c5018f728c2
failure! key: 1C587F1C13924FEF data:
305532286d6f295a
success! key: 0101010101010101 data:
123456789abcdef
success! key: 1F1F1F1F0E0E0E0E data:
123456789abcdef
failure! key: E0FEE0FEF1FEF1FE data:
123456789abcdef
success! key: 0000000000000000 data:
ffffffffffffffff
success! key: FFFFFFFFFFFFFFFF data: 00
failure! key: 0123456789ABCDEF data: 00
failure! key: FEDCBA9876543210 data:
ffffffffffffffff
//Test code. References to test variables are
//from http://www.counterpane.com/vectors2.txt.
int main(int argc, char* argv[])
{
{
unsigned long l,r;
int index;
int i;
for ( index=0; index <
NUM_VARIABLE_KEY_TESTS; index++)
{
l = plaintext_l[index];
r = plaintext_r[index];
InitializeBlowfish((char *)
variable_key[index], 8);
Blowfish_encipher(&l,&r);
if ((ciphertext_l[index] == l) &&
(ciphertext_r[index] == r))
{
printf("success!");
}
else
{
printf("failure!");
}
printf (" key: ");
for (i=0; i < 8; i++)
{
char f,s;
int iVal = (variable_key[index]
[i] & 0x000000FF);
f = s_acHexDigits[iVal >> 4];
s = s_acHexDigits[iVal &
0x0000000F];
printf("%c%c",f,s);
}
printf (" data: %x%x",plaintext_l
[index],plaintext_r[index] );
printf("\n");
}
}
return 0;
}
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: Bryan Olson <[EMAIL PROTECTED]>
Subject: Re: RSA public exponent
Date: Tue, 05 Sep 2000 23:24:08 GMT
Rich Wales wrote:
> One reason to prefer a relatively small public exponent is that there
> is a known attack against RSA if the private exponent is small (up to
> N/4).
If we choose a random public exponent the chance of the
private exponent being N/4 bits or shorter is about
2^-(3/4 N). An attacker can guess p or q on the first
try with greater probability.
There is good reason to use a small public exponent, but
worry that the private exponent will come out short is not
one of them. The conclusion to draw from the attacks on a
short d is that we must not deliberately choose a short
private exponent. They don't come out that by chance.
--Bryan
--
email: bolson at certicom dot com
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: Serpent S-boxes (again)
Date: Tue, 05 Sep 2000 23:25:38 GMT
In article <8p1onn$[EMAIL PROTECTED]>,
[EMAIL PROTECTED] (Gregory G Rose) wrote:
> >>sure of conform with anyone else's implementation. It is
> >>ALSO essential that the rationales of every part can be
> >>understood by those who care to know. If, taking the
> >>example of the present issue, the authors had during
> >>their design time some concrete design critiria for the
> >>S-Boxes, isn't it quite trivial to put these onto paper?
>
> I guess I'm confused again. Page 4 of the paper
> introducing Serpent-1 (the AES candidate) explains
> exactly their criteria, justification, and algorithm for
> generating the S-boxes.
>
> It is a pity that they goofed, and one of the
> sboxes is only of order 2 and not 3, but it
> appears to have been an honest mistake.
>
> I guess this could be considered an example of
> "proof by assertion", but, has anyone actually
> checked the stated algorithm to see if it does
> produce the chosen s-boxes?
The algorithm presented in the serpent paper is not complete they have
a step labeled "test for given criteria" which doesn't say "how" the
tests are done.
Tom
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: 4x4 s-boxes
Date: Tue, 05 Sep 2000 23:33:43 GMT
In article <[EMAIL PROTECTED]>,
[EMAIL PROTECTED] (Mack) wrote:
> >Douglas A. Gwyn <[EMAIL PROTECTED]> wrote:
> >: Terry Ritter wrote:
> >
> >:> While the FT originally defined "bent," most modern treatments use
> >:> the FWT.
> >
> >: ? What does the definition of bent function look like in terms
> >: of Walsh transforms?
> >
> >Bent function <-> "All entries in the WT have the same magnitude".
> >
> >: Is it as simple as the FT version?
> >
> >It's extremely simple.
> >
> >:> As far as I know, in modern open cryptography, these concepts
> >:> [maximal nonlinearity and uniform Fourier weights] are the same.
> >
> >: They can't be the same, because the latter defines a bent function
> >: but you guys are claiming that bent functions aren't maximally
> >: nonlinear.
> >
> >Only Tom's claiming that AFAICS. Everyone else appears to be
disagreeing.
>
> I believe tom's claim was that maximally non-linear functions were not
> balanced. As was mine. I could be wrong about tom's claim.
>
> My specific claim was that Bent functions only exist on equations
> of 2*n variables, are not balanced, and are maximally non-linear.
Hence
> cannot produce bijective s-boxes.
You guys are all wrong. In the original paper were "bent" was defined
there was no mention of non-balanced functions. In fact "bent" doesn't
refer to maximal non-linear functions at all.
Read up the papers, specially "Perfect Nonlinear Sboxes", Kaisa Nyberg,
Eurocrypt '91 P379. The term "bent" is defined in section 2.
Given the paper a 4x4 sbox is bent if and only if the highest absolute
WT value in the WT matrix is 4. In this case they use the Fourier
Transform as
F(w) = 1/sqrt(q^n) * sum (x in Zn/q) of (u^(f(x) - w.x)), w in Zn/q
Or in other words all |F(w)| = 1 for w in Zn/q.
I can provide a .ps transcription (with better math notation) to anyone
that asks.
Tom
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: Future Beacon <[EMAIL PROTECTED]>
Subject: Blowfish Questions
Date: Tue, 5 Sep 2000 19:45:48 -0400
Has the first Blowfish encryption algorithm been cracked?
Is there a stronger encryption method in the public domain?
Is there any stronger encryption method?
Thank you for your help.
Jim Trek
Future Beacon Technology
http://eznet.net/~progress
[EMAIL PROTECTED]
------------------------------
From: JCA <[EMAIL PROTECTED]>
Subject: Re: For those working on the next RSA factoring challenge...
Date: Tue, 05 Sep 2000 16:46:06 -0700
Would you care to give pointers tomore detailed analyses on this?
It's not that I don't believe you - I'd be interested to read technical
stuff on what kind of jobs are amenable to run in a Beowulf-style
device, and which ones require a fully-fledged supercomputer, and
why.
Jerry Coffin wrote:
> > But wouldn't a network of about 10-20 PIII-1000 MHz PC's do just as well,
> > for a fraction of the cost?
>
> No -- the matrix reduction phase of a GNFS doesn't distribute well at
> all. To do the job at all efficiently, you need a single machine
> with enough RAM to hold the entire matrix. In theory a Pentium III
> can address physical RAM in the terabyte range, but in reality most
> motherboards will only hold 768Mb or so. Worse, bandwidth to that
> memory is likely to be one of the major bottlenecks; the Cray uses
> SRAM for all of its main memory, giving high bandwidth even with the
> unpredictable memory usage pattern of matrix reduction. PCs reduce
> costs partly by using SDRAM instead, which won't give nearly the
> bandwidth in this situation.
>
> Loosely coupled parallel machines can do some jobs extremely well,
> but this job doesn't fall into that category. There are factoring
> algorithms that can be distributed, but they're all enough less
> efficient that a Cray running the GNFS would normally be faster for
> the sizes of numbers you'd think of for an RSA key.
>
> --
> Later,
> Jerry.
>
> The Universe is a figment of its own imagination.
------------------------------
From: [EMAIL PROTECTED] (Ernest Dumenigo)
Subject: question on book selection
Date: 5 Sep 2000 23:54:13 GMT
I was looking at the book suggestions everyone gave me, and a few that
that I seem to be interested in are the ones by Friedman.
I saw that he has two series the "Military cryptanalysis" and the
"Military Cryptanalytics", I was wondering if anyone had any critiques on
both to help me decide which one I should get. I feel that starting with
the basics will help me learn more, and give me a better understanding
of modern methods.
Thanks for your help!
--
=====
Ernest
------------------------------
From: [EMAIL PROTECTED] (Bill Unruh)
Subject: Re: Patent, Patent is a nightmare, all software patent shuld not be allowed
Date: 6 Sep 2000 00:02:53 GMT
In <[EMAIL PROTECTED]> Mok-Kong Shen <[EMAIL PROTECTED]> writes:
]> look at US Patent #5222140, "Cryptographic method for key agreement
]> and user authentication"? It appears to cover protocols where the
]> server sends its public key to a client, the client encrypts a session
]> key with that public key, and the server recovers it by decrypting
]> with its private key. Sound familiar to anyone?
]I seems as if most people doing PK today are infringing on
]lots and losts of patent rights. I find it very remarkable
To infringe the patent actually has to be valid. Infringing an invalid
patent is impossible. Of course ultimately a court would decide and
courts can sometimes be weird.
------------------------------
From: [EMAIL PROTECTED] (Bill Unruh)
Crossposted-To: talk.politics.crypto
Subject: Re: RSA Patent.
Date: 6 Sep 2000 00:07:07 GMT
In <39afbc61$[EMAIL PROTECTED]> "ajd" <[EMAIL PROTECTED]> writes:
>I hear that the patent for the RSA encryption algorithm expires at the end
>of this month. Does this mean that I can create commercial RSA
>software/chips with no licence/royalty issues? Was the patent for USA only
Yes.
>or did it include Europe?
NO. It was patented only in the USA. Everywhere else in the world you
have been able to use RSA without royalties since the invention.
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
