Cryptography-Digest Digest #654, Volume #12 Mon, 11 Sep 00 11:13:01 EDT
Contents:
Re: MAC ([EMAIL PROTECTED])
R: PRNG ("Cristiano")
R: Request for Blind Signature API ("Cristiano")
Re: PRNG ("NP")
MIRACL (Soeren Gammelmark)
Re: MAC ("kihdip")
Re: (Jury Selection) Re: Carnivore article in October CACM _Inside_Risks (Yiorgos
Adamopoulos)
Re: (Jury Selection) Re: Carnivore article in October CACM _Inside_Risks (Yiorgos
Adamopoulos)
Re: (Jury Selection) Re: Carnivore article in October CACM _Inside_Risks (Robert H.
Risch)
Re: Extremely small DES - sanity check (stanislav shalunov)
Re: (Jury Selection) Re: Carnivore article in October CACM _Inside_Risks (Yiorgos
Adamopoulos)
Re: Bytes, octets, chars, and characters (mike burrell)
Re: RSA public exponent (Paul Schlyter)
Re: Bytes, octets, chars, and characters (stanislav shalunov)
Re: Bytes, octets, chars, and characters (mike burrell)
Re: MAC (Ragni Ryvold Arnesen)
Re: RSA public exponent (Mark Wooding)
Re: MAC (Ragni Ryvold Arnesen)
Re: RSA public exponent (Mark Wooding)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED]
Subject: Re: MAC
Date: Mon, 11 Sep 2000 12:11:48 GMT
Thank you again for your help.
Brice.
In article <[EMAIL PROTECTED]>,
Ragni Ryvold Arnesen <[EMAIL PROTECTED]> wrote:
> [EMAIL PROTECTED] wrote:
>
> > So why not just use the old public key system to sign your message
then?
> >
> > The MAC method implies that the sender and receiver share a common
> > secret key. What are the benefits of MAC over standard signature
using
> > public key encryption?
>
> Less memory and CPU costs, no need for PKI, you can use the same
algorithm
> to ensure both confidentiality and integrity.
>
> MACs are particularly useful in mobile phones or other devices with
very
> limited memory, computational capabilities and bandwidth. For an
example,
> see the algorithm specifications for 3G/UMTS:
> http://www.etsi.org/dvbandca/3GPP/3gppspecs.htm
>
> KASUMI is the cipher algorithm, f8 is the confidentiality algorithm
> (encryption mode) and f9 is the integrity algorithm (MAC mode).
>
> -Ragni
>
>
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: "Cristiano" <[EMAIL PROTECTED]>
Subject: R: PRNG
Date: Mon, 11 Sep 2000 14:08:09 +0200
Paul Pires wrote:
> I was on my best behavior.
Just imagine when you are in your worst behavior!
>I notice you did not address my questions.
Do you remember this?:
> > I'd like to play with your code and diehard. But I don't wan't to
compile
> your
> > source. Do you have an executable that will run under DOS or in a DOS
> window and
> > some simple instructions on proper use?
>
> My prog run under Windows 98 and is too big to translate for DOS, but this
> is the very simple generator (by D. E. Knuth):
[...]
> Can you tell me something?
Where is your answere?
Probably you are usual to deal with pigs!
Please quiet down!
Cristiano
------------------------------
From: "Cristiano" <[EMAIL PROTECTED]>
Subject: R: Request for Blind Signature API
Date: Mon, 11 Sep 2000 14:28:36 +0200
Joyce wrote:
> Would you tell me where Blind Signature API (in Java / C++) can be found
or
> how to write a Blind Signature function?
Suppose you are A and you want to send a blind message m to B.
This is the way with RSA.
Bn is the modulus of B (public);
Be is the public exponent of B;
Bd is the private key of B.
Choose a random number r prime with Bn (and lesser than this) so
gcd(r,Bn)=1;
Compute t=(m*(r^Be mod Bn)) mod Bn;
B sign the blind message t (without learn about it) in this way:
b=t^Bd mod Bn
A verify the signature:
vs=b^Be mod Bn
if vs=t the signature is valid.
A compute the signature of m:
bs=(b*(r^-1 mod Bn)) mod Bn
(r^-1 mod Bn is the inverse of r with respect to Bn)
bs is the same as m^Bd mod Bn, but in this case B can see the message.
Of course, you can blind a message also by using elliptic curve method or
another one.
Cristiano
------------------------------
From: "NP" <[EMAIL PROTECTED]>
Subject: Re: PRNG
Date: Mon, 11 Sep 2000 14:44:40 +0200
> > In addition I analyse Gauss distribution for Byte and word collision.
>
> Can you be a little bit clear?
Simple test: I write a file containing all results > 1Gbytes
I count the number collision for each 16 bits value ( 16 bits is what I
want )
Result is a gauss repartition of collision.
After 400 million values collected, I see some sub-wave in the gauss curve.
It is meaning FFT gives some frequencies ...
It's a bias in the gauss repartition ( !? )
NP nicolas.
------------------------------
From: Soeren Gammelmark <[EMAIL PROTECTED]>
Subject: MIRACL
Date: Mon, 11 Sep 2000 14:51:01 +0200
Hi
A few days ago i downloaded the MIRACL library at
http://indigo.ie/~mscott/
but I can't make it work. I suspect it is because I don't know enough
about my compiler and computer (and I am a self-lerned programmer). If
anyone can help me, I would appreciate it. I have the Borland C++
Builder 1.0 Standard edition program suite, and with that comes the
bcc32.exe-compiler. When I try to run the BC32DOIT.BAT to create the
library I get tons of error messages.
------------------------------
From: "kihdip" <[EMAIL PROTECTED]>
Subject: Re: MAC
Date: Mon, 11 Sep 2000 14:59:07 +0200
Do you know how secure these 3G/UMTS algorithms are compared to 3xDES or one
of the AES candidates ??
Kim
------------------------------
From: [EMAIL PROTECTED] (Yiorgos Adamopoulos)
Crossposted-To: comp.security.misc,alt.security,talk.politics.crypto,us.legal
Subject: Re: (Jury Selection) Re: Carnivore article in October CACM _Inside_Risks
Date: 11 Sep 2000 13:03:04 GMT
Reply-To: [EMAIL PROTECTED]
In article <[EMAIL PROTECTED]>, Matthew
Montchalin wrote:
>|[ Then again I live in Greece, so I may be off track on the jury
>|selection process in the US ]
>
>Isn't Greece a civil code country? But surely they *impanel juries*
>for significant questions of fact?
>
>Can you tell me a little bit about the voir dire process as it is
>practiced in Greece?
Yes. When there are trials that require juries, there is a score of 4
judges and 3 jurors (sp?). If you are selected as one, you cannot
excuse yourself (unless of course you make the 4 judges believe that you
are not objective in judgement). Jurors can be anyone who has the right
to vote and has not been convicted.
------------------------------
From: [EMAIL PROTECTED] (Yiorgos Adamopoulos)
Crossposted-To: comp.security.misc,alt.security,talk.politics.crypto,us.legal
Subject: Re: (Jury Selection) Re: Carnivore article in October CACM _Inside_Risks
Date: 11 Sep 2000 13:19:49 GMT
Reply-To: [EMAIL PROTECTED]
In article <[EMAIL PROTECTED]>, Tony T. Warnock wrote:
>> Can you tell me a little bit about the voir dire process as it is
>> practiced in Greece?
>
>Asking something about Abelian Varieties is fun too.
http://www.google.com/search?q=cache:www.ams.org/mathcal/info/2000_jul29-aug4_crete.html+abelian+varieties
:-)
------------------------------
From: Robert H. Risch <[EMAIL PROTECTED]>
Crossposted-To: comp.security.misc,alt.security,talk.politics.crypto,us.legal
Subject: Re: (Jury Selection) Re: Carnivore article in October CACM _Inside_Risks
Reply-To: [EMAIL PROTECTED]
Date: Mon, 11 Sep 2000 13:29:53 GMT
On 11 Sep 2000 13:03:04 GMT, [EMAIL PROTECTED] (Yiorgos
Adamopoulos) wrote:
>>Can you tell me a little bit about the voir dire process as it is
>>practiced in Greece?
>
>Yes. When there are trials that require juries, there is a score of 4
>judges and 3 jurors (sp?). If you are selected as one, you cannot
>excuse yourself (unless of course you make the 4 judges believe that you
>are not objective in judgement). Jurors can be anyone who has the right
>to vote and has not been convicted.
Please give us more details. Which cases have juries? To what extent
can the jurors participate during the trial, ie can they ask questions
or must they remain silent? During the selection of jurors, can the
lawyers ask that a juror they don't like be taken off the jury? Who
votes at the end, judges and jurors or just jurors? How many votes
are needed for a decision? At the trial, does each side present a
case or is there only one "file" where the judges decide who the
witnesses should be and the lawyers can only question them after the
judges (and jurors?) have finished their questions? Many thanks.
RHR
------------------------------
From: stanislav shalunov <[EMAIL PROTECTED]>
Subject: Re: Extremely small DES - sanity check
Date: 11 Sep 2000 09:43:57 -0400
Eric Furbish <[EMAIL PROTECTED]> writes:
> 16 bit blocks, and 16 bit keys.
Don't bother with a DES variant for this. You could just as well do
cheaper XOR.
Seriously, 16 bits is ridiculous. See if you can find some tiny
stream cipher that you can implement given your hardware constraints.
--
Stanislav Shalunov Internet2
"A Rodbertus cabinet would be the cipher in which plus and minus
neutralize each other." -- Karl Marx
------------------------------
From: [EMAIL PROTECTED] (Yiorgos Adamopoulos)
Crossposted-To: comp.security.misc,alt.security,talk.politics.crypto,us.legal
Subject: Re: (Jury Selection) Re: Carnivore article in October CACM _Inside_Risks
Date: 11 Sep 2000 13:44:19 GMT
Reply-To: [EMAIL PROTECTED]
In article <[EMAIL PROTECTED]>, Robert H. Risch wrote:
>Please give us more details. Which cases have juries? To what extent
Violent crimes for sure. I'll have to check if they are included in
economic crimes also.
>can the jurors participate during the trial, ie can they ask questions
>or must they remain silent? During the selection of jurors, can the
They can ask questions. The judges also ask questions.
>lawyers ask that a juror they don't like be taken off the jury? Who
No. Selectiong is the responsibility of the 4 judges.
>votes at the end, judges and jurors or just jurors? How many votes
All 7 of them.
>are needed for a decision? At the trial, does each side present a
4
>case or is there only one "file" where the judges decide who the
>witnesses should be and the lawyers can only question them after the
>judges (and jurors?) have finished their questions? Many thanks.
There exist cases where the judges decide based on the "file" but these
are usually economic cases, cases that involve tax reduction. In crime
cases everyone takes turn as many times as one wants to ask the witness
(that means the 4 judges, the 3 jurors and the lawyers). When both
sides present experts on a subject who state different oppinions, the
court can decide to ask an external third party who is considered as an
authority on the subject of the case. And since we are a small country
(10M) it is very easy to locate the experts without having to question
their integrity.
------------------------------
From: mike burrell <[EMAIL PROTECTED]>
Subject: Re: Bytes, octets, chars, and characters
Crossposted-To: comp.lang.c
Date: Mon, 11 Sep 2000 13:58:10 GMT
In comp.lang.c Douglas A. Gwyn <[EMAIL PROTECTED]> wrote:
> there is no reason to think that 64 bits is as wide an integer
> type as the language needs to accommodate; we already need 128
> bits for an IPv6 address, for example. We made a good start at
> accommodating such types in C99, so that there should be no further
> disruptions as this area evolves further.
IP addresses (with one exception that i can think of) are treated as arrays
of characters, not integers (not enough that anyone would do any arithmetic
on them anyway). at some point you just have to say that you're going to
use a platform-specific extension or use bignums. we have to think of those
poor 8-bit micros too, you know. i'm sure making a 128-bit integer is no
day in the park for them.
--
/"\ m i k e b u r r e l l
\ / ASCII RIBBON CAMPAIGN [EMAIL PROTECTED]
X AGAINST HTML MAIL,
/ \ AND NEWS TOO, dammit finger [EMAIL PROTECTED] for GPG key
------------------------------
From: [EMAIL PROTECTED] (Paul Schlyter)
Subject: Re: RSA public exponent
Date: 11 Sep 2000 15:29:27 +0200
In article <8ph4ph$esm$[EMAIL PROTECTED]>,
Ed Pugh <[EMAIL PROTECTED]> wrote:
> Thomas Pornin ([EMAIL PROTECTED]) writes:
>> According to Paul Schlyter <[EMAIL PROTECTED]>:
>>> If I instead wanted a full-length public exponent too, it must
>>> be selected somehow. How would I do that?
>>
>> Select it at random. All that is required is that it must be relatively
>> prime to phi(N)=(p-1)(q-1) where N=pq is the modulus.
>>
>> 65537 is useful because it is prime, and therefore has a high probability
>> of being relatively prime to phi(N) for a randomely chosen N. But there
>> is no obligation to choose a prime number.
>
> When generating keys, we can "set" one exponent to a specific number
> and let the algorithm find the other exponent. Both exponents must
> be relatively prime to phi(N) (as stated elsehwere). If one is r.p.
> to phi(N), then so is the other. Therefore we must choose one
> exponent to be r.p. to phi(N), and let the algorithm select the other
> exponent.
>
> Now, if the chosen exponent is small (in comparison with N), then the
> other exponent will most likely be large (AFAIK; someone please correct
> me if I am wrong about this). Therefore, it is best to choose the
> public exponent to be relatively small, so that the secret exponent
> will be large.
You seem to suggest that if we choose one exponent large, then it'll
be likely that the other exponent is small. That cannot be the case,
since if we've selected e, then we compute d from:
d = 1/e mod (p-1)(q-1)
Since each e yields a unique d, and since there are so many more "large"
numbers than "small" numbers, it must be very unlikely that any particular
"large" e would produce a "small" d.
> Also, it is more efficient for the encryption algorithm if the public
> exponent has the smallest possible "binary weight" (i.e. the smallest
> possible number of set bits). (For the "fast" modular exponential
> algorithm, the time to do it is proportional to the bit length plus
> the binary weight -- i.e. the number of set bits -- of the public
> exponent.)
That's the REAL reason why a "small" public exponent is preferred.
> Therefore, it is usually easiest to use a PRIME public exponent of the
> form 2^k + 1, where k is an integer that makes the result prime. (A
> prime public exponent has a higher probability of being r.p. to phi(N)
> than a non-prime exponent would, so we choose a prime one.)
>
> For this reason, RSA often uses public exponents 3 (2^1 = 1), 17
> (2^4 + 1) and 65537 (2^16 + 1).
The actual form is: Fn = 2^2^n + 1 which is the Fermat numbers
The first few Fermat numbers are:
3, 5, 17, 257, 65537, 4294967297, 18446744073709551617
Of these, all are primes up to 65537, which is the largest known
Fermat prime. The next two, for instance, are non-primes:
4294967297 = 641 * 6700417
18446744073709551617 = 274177 * 67280421310721
For more info about Fermat numbers, see:
http://mathworld.wolfram.com/FermatNumber.html
> Since it is actually the secret exponent that we want to keep from
> being found, I am not really sure that the size of the public exponent
> has much bearing on the security of the secret key. (Again, though,
> somebody please correct me if I am wrong about this.) Therefore, I
> believe we can use smaller public exponents without compromising the
> security of the secret key.
Using very small public exponents, like 3 or 5, is discouraged
nowadays though, for security reasons. 65537 seems safe enough
though.
> One thing to keep in mind, though, is that there are actually
> INFINITELY MANY (Aleph-Null, to be exact) secret exponents for any
> one public exponent. The smallest secret exponent can be found by
> d = (e^-1) [mod (LCM((p-1),(q-1))], where e is the public exponent,
> N = pq and LCM(a,b) is the least common multiple of a and b. Any
> number congruent to d [ mod (LCM(p-1),(q-1))] will work as the secret
> exponent for RSA decryption. Therfore if an attacker can find ANY
> such value, then the secret key has been broken.
Sure, but aren't all but one of these secret exponents larger than
the modulus? And doesn't one assume that the exponents are always
smaller than the modulus?
> It is (AFAIK) currently believed that factoring N is the easiest way
> to find the secret exponent of a RSA key. I often wonder, however,
> if there may be an easier attack available, given the fact that
> there are infinitely many possible secret exponents.
I don't think such an attack is easire, because then you don't need
to consider only the keyspace 1..(N-1) but instead all of 1..(infinity)
BTW there are other curiosities of RSA. Such that for each RSA keys,
there are at least nine different plaintexts which are equal to their
cryptotexts. Two trivial examples are the plaintexts 0 and 1: raising
0 or 1 to any power will just yield -- 0 or 1....
--
================================================================
Paul Schlyter, Swedish Amateur Astronomer's Society (SAAF)
Grev Turegatan 40, S-114 38 Stockholm, SWEDEN
e-mail: pausch at saaf dot se or paul.schlyter at ausys dot se
WWW: http://hotel04.ausys.se/pausch http://welcome.to/pausch
------------------------------
From: stanislav shalunov <[EMAIL PROTECTED]>
Crossposted-To: comp.lang.c
Subject: Re: Bytes, octets, chars, and characters
Date: 11 Sep 2000 10:24:39 -0400
mike burrell <[EMAIL PROTECTED]> writes:
> IP addresses (with one exception that i can think of) are treated as
> arrays of characters, not integers (not enough that anyone would do
> any arithmetic on them anyway).
Internally, IP numbers are almost always converted to binary mode.
That's how you show them to your system's socket API.
Arithmetic on them is used, too: bitwise operations for netmasks.
--
Stanislav Shalunov Internet2
"Nuclear war would really set back cable [television]." -- Ted Turner
------------------------------
From: mike burrell <[EMAIL PROTECTED]>
Subject: Re: Bytes, octets, chars, and characters
Crossposted-To: comp.lang.c
Date: Mon, 11 Sep 2000 14:36:03 GMT
In comp.lang.c stanislav shalunov <[EMAIL PROTECTED]> wrote:
> mike burrell <[EMAIL PROTECTED]> writes:
>> IP addresses (with one exception that i can think of) are treated as
>> arrays of characters, not integers (not enough that anyone would do
>> any arithmetic on them anyway).
> Internally, IP numbers are almost always converted to binary mode.
> That's how you show them to your system's socket API.
> Arithmetic on them is used, too: bitwise operations for netmasks.
i know. but if you're coding in a mythical InternetOS, you don't have:
struct remote_host {
unsigned long long long IP_address;
};
you have instead:
struct remote_host {
unsigned char *IP_address;
};
or
struct remote_host {
unsigned char IP_address[16];
};
likewise, when you're applying a netmask, you don't apply it all at once
(well OK, you could get away with it with IPv4 addresses); you do it
possibly byte-by-byte:
for (i = 0; i < 16; i++)
IP_address[i] &= netmask[i];
--
/"\ m i k e b u r r e l l
\ / ASCII RIBBON CAMPAIGN [EMAIL PROTECTED]
X AGAINST HTML MAIL,
/ \ AND NEWS TOO, dammit finger [EMAIL PROTECTED] for GPG key
------------------------------
From: Ragni Ryvold Arnesen <[EMAIL PROTECTED]>
Subject: Re: MAC
Date: Mon, 11 Sep 2000 16:36:37 +0200
kihdip wrote:
> Do you know how secure these 3G/UMTS algorithms are compared to 3xDES or one
> of the AES candidates ??
The requirements specified prior to the design of the algorithms (3G TS 33.105)
and a public evaluation report (3G TR 33.908) are available at
ftp://ftp.3gpp.org/Specs/March_00/33_series/
The f8 and f9 algorithms are designed with one particular use in mind (UMTS) and
are by no means meant to be general purpose algorithms. Used in other contexts
it may be possible to launch some attacks against them that are not possible
when used in UMTS.
KASUMI on the other hand is an 8-round block cipher with a recursive Feistel
structure and 128 bit keys. As far as I know, it is possible to attack up to 6
rounds of KASUMI, but not the full 8 rounds. The best attack requires som rather
complicated differential and linear cryptanalysis.
KASUMI is based on MISTY1 designed by Mitsuru Matsui ('kasumi' is Japanese for
'mist'), an algorithm that has been subject to a great deal of analysis in
Japan. Both KASUMI and MISTY1 are very elegant and easy to implement both in
software (must be, since even I could get it right :-) and in hardware.
In short, if you think 128 bit keys is good enough, I believe KASUMI is a good
cipher.
-Ragni
------------------------------
From: [EMAIL PROTECTED] (Mark Wooding)
Subject: Re: RSA public exponent
Date: 11 Sep 2000 14:44:23 GMT
[EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
> On the other hand, has it been proven that there is no other more
> efficient crack (other than finding the secret key)?
No. This is still an open question. Note that that wasn't the question
I was answering, though.
-- [mdw]
------------------------------
From: Ragni Ryvold Arnesen <[EMAIL PROTECTED]>
Subject: Re: MAC
Date: Mon, 11 Sep 2000 16:45:20 +0200
Ragni Ryvold Arnesen wrote:
> In short, if you think 128 bit keys is good enough, I believe KASUMI is a good
> cipher.
What I forgot to say is of course that KASUMI is the property of 3GPP (or is it
Mitsubishi? -I don't remember what they agreed upon). But anyway I don't think
whoever owns it will give licenses to use it for other purpose than UMTS.
-Ragni
------------------------------
From: [EMAIL PROTECTED] (Mark Wooding)
Subject: Re: RSA public exponent
Date: 11 Sep 2000 14:53:07 GMT
Paul Schlyter <[EMAIL PROTECTED]> wrote:
> Sure, but aren't all but one of these secret exponents larger than the
> modulus? And doesn't one assume that the exponents are always smaller
> than the modulus?
No. Carmichael's lambda function gives an upper bound on the order of
any element of Z_n as \lambda(n) = \lcm(p - 1, q - 1). This is at best
half of \phi(n) = (p - 1)(q - 1), and at worst could be much smaller.
Let d = e^{-1} (mod \lambda(n)) be the smallest private exponent. Then
any other private exponent d' must also have this property, so d' = d
(mod \lambda(n)). The value of \gcd(p - 1, q - 1) determines exactly
how many such d' there are between 0 and \phi(n).
Note that randomly chosen p and q are very unlikely to give a large
common factor of p - 1 and q - 1.
-- [mdw]
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
