Cryptography-Digest Digest #295, Volume #14 Sat, 5 May 01 07:13:01 EDT
Contents:
Micali-Schnorr pseudorandom bit generator ("Dobs")
Re: Why Not OTP ? ("Henrick Hellstr�m")
Re: Best encrypting algoritme ("Jack Lindso")
Re: Random and not random (Matthew Skala)
SRP attack? ("Michael Scott")
WHY I HATE BOSCHLOO (Fight Boschloo)
Re: Random and not random (Mok-Kong Shen)
Re: linear vs nonlinear (Mok-Kong Shen)
Polymorphic Encryption ("Kostadin Bajalcaliev")
Re: linear vs nonlinear (Leonard R. Budney)
----------------------------------------------------------------------------
From: "Dobs" <[EMAIL PROTECTED]>
Subject: Micali-Schnorr pseudorandom bit generator
Date: Sat, 5 May 2001 00:20:52 +0200
Could You please help me. I am trying to implement Micali-Schnorr
pseudorandom bit generator. However I have a problem. In the algorithm there
is written that:
Yi Xi-1^e mod n
Xi the r most significant bits of Yi
Zi the k least significant bits of Yi
The problem is as follow:
Lets say that e=3, r =683, k=341, n is 1024 bits long. I select randomly Xo
of bitlength r. I counte Y0=X1^e mod n so in fact Y0 can be a number
between 1 and n. Let say that it has happen that Y0=5 (in binary: 101) Now
to counte X1 we take the r most significant bits of Yi so in our case we
take 683 bits from Y1. Our X1 will be (680 zeros and 101)
0000000000000000000000....00000101
Our output Z1 will be 341 least significant bits of 101 so it will be (338
zeros and 101) 0000000000...00000101 so in our output apeares a lot of 0'
s.
My output very often looks like this a lot of zeros than some mixed 1's and
0's than one more thime a lot of zeros than some 1's and 0's and so on and
so on...
More or less something like this:
0000000000000000000000000000000000000000000000000000000000000000000000000001
0111101101010101010000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000011111101010100101010011011
1100000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000001100011110101011101011110000000000000000
00000000000000000000000000000000000000000000000000000000
So what about this zero's??? What to do with them, this output looks not
like random? This zero's will always be if the bitlength of Yi will be less
then k.
How to solve this problem??????
------------------------------
From: "Henrick Hellstr�m" <[EMAIL PROTECTED]>
Subject: Re: Why Not OTP ?
Date: Sat, 5 May 2001 01:10:29 +0200
"Bo D�mstedt" <[EMAIL PROTECTED]> skrev i meddelandet
news:[EMAIL PROTECTED]...
> ... Can a CD writer be modified to first read and then
> overwrite data ?
Sure, use a regular CD-R/W, but make sure it doesn't use the HD for
temporary data storage during read/write operations, and you should
literally burn the disk when it's empty.
--
Henrick Hellstr�m [EMAIL PROTECTED]
StreamSec HB http://www.streamsec.com
------------------------------
From: "Jack Lindso" <[EMAIL PROTECTED]>
Subject: Re: Best encrypting algoritme
Date: Sat, 5 May 2001 02:38:04 +0200
> Your question is silly. There are so many other holes in your system
> that your question is irrelevant. Something like 56 bit
> DES would probably already be overkill. (And yes I say this having
> never seen your system).
You're quite write however it doesn't mean that the crypto should not be the
best you can get. Why add any more holes when you have enough. And yes the
question should be rephrased.
--
Anticipating the future is all about envisioning the Infinity.
http://www.atstep.com
====================================================
"Bill Unruh" <[EMAIL PROTECTED]> wrote in message
news:9cv7hu$l06$[EMAIL PROTECTED]...
> In <e2DI6.7260$[EMAIL PROTECTED]> "david"
<[EMAIL PROTECTED]> writes:
>
> >Hi all.
> >Im making a backup program, and I don'treally know what is the most
secure
> >algoritme, im using Rijndael rigth now and using 256 bit keys, are rc6
> >stronger or are there others??
>
> I want to put a bumper on my 1950 VW. At present I have put on a 1 foot
thick
> Ibeam, but am wondering whether a 24 inchdiameter log might not be better.
What
> is the best bumper for my VW?
>
> Your question is silly. There are so many other holes in your system
> that your question is irrelevant. Something like 56 bit
> DES would probably already be overkill. (And yes I say this having
> never seen your system).
>
>
>
------------------------------
From: [EMAIL PROTECTED] (Matthew Skala)
Subject: Re: Random and not random
Date: 4 May 2001 19:23:13 -0700
In article <[EMAIL PROTECTED]>,
Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
>the pad could be debated later.) To repeat: I have three
>segments S1, S2 and S3 obtained from the OTP source, and
>I have in my hand three messages denoted (named) M1,
>M2 and M3 (these are NOT a priori ordered in any sense,
>i.e. the suffixes 1, 2 and 3 do not give any ordering),
>MUST I process M1 with S1, M2 with S2 and M3 with S3
>OR am I on the other hand entirely FREE to CHOOSE (say,
>just according to what I momentarily find convenient with
>my hand to handle these messages) which messages to be
Assuming you want perfect secrecy, you are free to choose a permutation,
if and only if you do so in a way that is independent of the pads.
>be in the order S1, S2, S3)? Only after you give a clear
>and definitive answer (including a global Yes/No) to this
>short yet very essential and critical question could we
>profitably proceed to further points of our debate in my
>humble view.
You could choose a permutation in a way that is A. dependent on the pad,
or B. independent of the pad.
If I say "yes" to your question above, then it appears you will
immediately try to construct an algorithm in category A - which, as I have
proved, cannot have the perfect secrecy property. If I say "no" to your
question, then you will complain about the fact that I have ruled out the
algorithms in category B which clearly do have the perfect secrecy
property. Moreover, you appear unwilling or unable to grasp the
difference between the two kinds of algorithms.
I cannot say flatly "yes" or "no" to your question, because you are
insisting that I ignore the method you use to generate the permutation -
and that method makes all the difference in the world.
Here's an example.
Suppose we have two worlds.
In world A, you have three messages M1, M2, and M3 and three pad segments
S1, S2, and S3. You encrypt M1 with S1 to obtain C1, M2 with S2 to
obtain C2, and M3 with S3 to obtain C3.
In world B, it's just the same, except you test S1 to see whether it is
the all-zeroes pad. If it is, you encrypt M1 with S3 to obtain C1, M2
with S2 to obtain C2, and M3 with S1 to obtain C3; if S1 is not the
all-zeroes pad, then you encrypt exactly as in world A.
Suppose I obtain, via espionage, all the ciphertexts, and also M2 and
M3. Does this improve the odds on any bets I could make about M1?
In world A, it doesn't. There is some chance that S1 was all zeroes, and
in that case my intercepted C1 would be equal to M1, but I wouldn't know
that. The chance of it being true is exactly the same as my chance of
guessing M1 correctly just by guessing it at random.
But in world B, knowledge of C1, C2, C3, M2, and M3 does give me a
very small clue about M1. C1 is equal to M1 only if both S1 and S3 were
all zeroes. The chance of that is much smaller than the chance of just S1
being all zeroes. Now I can say, "I don't know what M1 is, but I know it
almost certainly isn't equal to C1." That's something I didn't know
before I intercepted your transmissions, and it's something I didn't know
in world A. As a result of the selection procedure in world B, you have
leaked a small but nonzero and precisely measurable amount of information
to me.
You are less secure in world B than in world A.
--
Matthew Skala
[EMAIL PROTECTED] "I fish stranger things than you
http://www.islandnet.com/~mskala/ out of my granola every morning."
------------------------------
From: "Michael Scott" <[EMAIL PROTECTED]>
Subject: SRP attack?
Date: Fri, 4 May 2001 23:06:05 -0500
I think I have a sort of attack against the SRP log-in protocol, as
described in
http://www-cs-students.stanford.edu/~tjw/srp/doc.html.
Its not by any means a devastating attack, but interesting I think
nonetheless.
A clearly desirable property of such protocols is that an active attacker
masquerading as either the client or the server should be able to eliminate
only one candidate secret x =H(s,P) with each attempt, where P is the
password under attack. Clearly it is impossible to do any better than this.
In fact a masquerading server, Stevie, can eliminate two candidate passwords
P1 and P2 at once. The SRP paper in fact makes no claims in this regard, so
perhaps this is not regarded as significant. Let x=H(s,P1) and y=H(s,P2).
In Step 3 Carol sends A=g^a
In Step 4 of the protocol the false server Stevie sends B=g^x+g^y. He then
sends B and a random value u to Carol. The idea is to eliminate both P1 and
P2 from his table of possible secret passwords for Carol.
If the real password is P1, Carol calculates S=(g^x+g^y-g^x)^(a+ux) = g^ya
.g^xuy . Stevie can also calculate this value (note that g^ya = A^y) and
check it against Carols proof send in step 7.
If the real password is P2, Carol calculates S=(g^x+g^y-g^y)^(a+2uy) =
g^xa.g^xuy. Again Stevie can calculate this value and check it against
Carol's proof.
Maybe someone spotted this before?
Mike Scott
------------------------------
Date: 4 May 2001 22:11:46 -0000
From: [EMAIL PROTECTED] (Fight Boschloo)
Subject: WHY I HATE BOSCHLOO
Crossposted-To: alt.privacy.anon-server,alt.security-pgp
I hate Boschloo
===============================================
HISTORY:
That Boschloo bozo is a clown and a troll who has been looming around for nearly a
year.
Don't mistake a "regular" (troll) with a knowledgeable person: that self-proclaimed
"security expert" is not even a remailer user. In the past, he proved himself unable
to check a PGP signature, and got ridicule from every single technical topic he wanted
to talk about.
Besides false or inaccurate or misleading technical misinformation, his posts are
about his avowed mental illness, or for bashing remops or real freedom fighters: he
likes to quarrel with every one, and stir shit. Sometimes, it is even pure delirium
(when he misses his pills?)
One of his last actions was to stage a hoax about his own suicide, just to try to grab
some sympathy, after he had been exposed as a troll and technically incompetent.
The worst being his teasing of Script-Kiddie until it triggered a new flood on apas.
Of course, he refuses to apologize.
Actually, the level of contempt he shows for remailer users:
they don't give their names, while he does
that can't do anything against him, without giving their names
is in no way different from what is displayed by Pangborn, Burnore and the like
Ignore him completely, killfile him, respect others' killfiles
KILLFILE:
To put him in your killfile, put "Author: Boschloo"
That will make disappear both him and people who warn about him
If you want to tell him to buzz off, or warn about him,
use a nickname containing "Boschloo" (Boschloo Hater, Boschloo Sucks,...)
to accomodate such killfile for "regulars", and still warn newbies
COURAGE:
Boschloo is getting _no_ answer from apas any more.
He has to crosspost to various newsgroups to try to grab some attention.
In a few months, it will be gone.
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: Random and not random
Date: Sat, 05 May 2001 11:12:11 +0200
Matthew Skala wrote:
>
> Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
> >the pad could be debated later.) To repeat: I have three
> >segments S1, S2 and S3 obtained from the OTP source, and
> >I have in my hand three messages denoted (named) M1,
> >M2 and M3 (these are NOT a priori ordered in any sense,
> >i.e. the suffixes 1, 2 and 3 do not give any ordering),
> >MUST I process M1 with S1, M2 with S2 and M3 with S3
> >OR am I on the other hand entirely FREE to CHOOSE (say,
> >just according to what I momentarily find convenient with
> >my hand to handle these messages) which messages to be
>
> Assuming you want perfect secrecy, you are free to choose a permutation,
> if and only if you do so in a way that is independent of the pads.
Given a perfect OTP source, I DO want perfect secrecy.
The question is whether I am ENTIRELY free to choose
a permutation out of the ensemble of all possible ones.
IF I am ENTIRELY free, THEN by 'definition' I CAN choose
it in any way I (personally) LIKE, including e.g. asking a
friend for advise, and that without ANY adverse effects.
For otherwise I would have to take care to avoid possible
negative effects and I wouldn't be ENTIRELY free at all.
Isn't that very clear? (If I am not ENTIRELY free in
that, please say where there is a such a claim that is
concretely explicitly and unambigiously to be taken from
the literatures on OTP, including Shannon's classical
papers.)
To repeat, let's consider the following scenario.
Imagine you were the person responsible for encryption
of a firm and you have three messages, M_m, M_p, M_a
(meaning marketing, production and administration
respectively) to process and you get from your OTP
source three segments S1, S2 and S3. How would you
map (associate) the messages to the segments? From
a theoretical standpoint, i.e. assuming a perfect
OTP, isn't that ANY of the 6 mappings is EQUALLY good?
If (really) yes, what kind of harm would result if you
have a 'particular' (habitual) way of mapping these, say
(1) according to the time sequence of these arriving at
your desk, (2) taking the reverse order of (1)?
Note that you have apparently ignored the assumption of a
'perfect' OTP, where each bit is (rigorously) INDEPENDENT
of the others. If the source in non-perfect, then some
preferred choices in the processing could INDEED matter.
But we are arguing in the theoretical situation here!
>
> >be in the order S1, S2, S3)? Only after you give a clear
> >and definitive answer (including a global Yes/No) to this
> >short yet very essential and critical question could we
> >profitably proceed to further points of our debate in my
> >humble view.
>
> You could choose a permutation in a way that is A. dependent on the pad,
> or B. independent of the pad.
>
> If I say "yes" to your question above, then it appears you will
> immediately try to construct an algorithm in category A - which, as I have
> proved, cannot have the perfect secrecy property. If I say "no" to your
> question, then you will complain about the fact that I have ruled out the
> algorithms in category B which clearly do have the perfect secrecy
> property. Moreover, you appear unwilling or unable to grasp the
> difference between the two kinds of algorithms.
>
> I cannot say flatly "yes" or "no" to your question, because you are
> insisting that I ignore the method you use to generate the permutation -
> and that method makes all the difference in the world.
>
> Here's an example.
>
> Suppose we have two worlds.
>
> In world A, you have three messages M1, M2, and M3 and three pad segments
> S1, S2, and S3. You encrypt M1 with S1 to obtain C1, M2 with S2 to
> obtain C2, and M3 with S3 to obtain C3.
>
> In world B, it's just the same, except you test S1 to see whether it is
> the all-zeroes pad. If it is, you encrypt M1 with S3 to obtain C1, M2
> with S2 to obtain C2, and M3 with S1 to obtain C3; if S1 is not the
> all-zeroes pad, then you encrypt exactly as in world A.
>
> Suppose I obtain, via espionage, all the ciphertexts, and also M2 and
> M3. Does this improve the odds on any bets I could make about M1?
>
> In world A, it doesn't. There is some chance that S1 was all zeroes, and
> in that case my intercepted C1 would be equal to M1, but I wouldn't know
> that. The chance of it being true is exactly the same as my chance of
> guessing M1 correctly just by guessing it at random.
>
> But in world B, knowledge of C1, C2, C3, M2, and M3 does give me a
> very small clue about M1. C1 is equal to M1 only if both S1 and S3 were
> all zeroes. The chance of that is much smaller than the chance of just S1
> being all zeroes. Now I can say, "I don't know what M1 is, but I know it
> almost certainly isn't equal to C1." That's something I didn't know
> before I intercepted your transmissions, and it's something I didn't know
> in world A. As a result of the selection procedure in world B, you have
> leaked a small but nonzero and precisely measurable amount of information
> to me.
>
> You are less secure in world B than in world A.
See what I wrote above. Note also that in the particular
point currently under discussion (in constrast to another
situation where I considered two classes of messages,
the more important and less important ones) there is YET
in the course of our discussion no saying of the 'nature'
of the messages. They are all 'equivalent' in the sense
that they all need the (same) perfect secrecy provided by
OTP according to theory. So what is exactly the kind of
'clues' you would be getting at all, since we haven't
even 'defined' the 'nature' of messages, let alone their
'contents' in specific instances of the messages??
Since EACH of the OTP segments is EQUALLY good according
to theory, it follows that ANY ordering of messages to be
processed is EQUALLY good regarding security, whether
that 'ANY' in any specific case of processing is determined
according to the timely order of their arrival, according
to a decision by my tiny young niece or simply according
to my feeling of the gut, isn't it??
M. K. Shen
==============================
http://home.t-online.de/home/mok-kong.shen
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: linear vs nonlinear
Date: Sat, 05 May 2001 11:40:34 +0200
Tom St Denis wrote:
>
[snip]
> Bingo. So a ring is like a field except not all elements are units right?
My knowledge is very humble, but I don't feel comfortable
with what you say above, which seems to be a bit too 'loose'.
The best is to start from a general definition of a ring and
consider a field to be a special case of a ring, I suppose.
M. K. Shen
------------------------------
From: "Kostadin Bajalcaliev" <[EMAIL PROTECTED]>
Subject: Polymorphic Encryption
Date: Sat, 5 May 2001 10:46:24 +0200
Hello
Here is something interesting. More about this design approach can be found
on web (addresses listed below), there is a draft version of my thesis about
Polymorphic Encryption.
B0 B1 B2 B3 - are 32-bit words, Message BLOCK
S0 S1 ... S15 - 32-bit words, the KEY
F[0..0xFFFFFFFF](A1,A2) - array of functions returning 32-bit word
Each Round is Defined as
B3^=F[B0](B1,B2);
(B0,B1,B2,B3)=(B3,B0,B1,B2) /* rotation */
The function is defined as:
T{i,j} denote the number formed from the i-th to the j-th bit of T
Op = {+,xor,*,-}; Op[i] denote the i-th element of set Op
F[G](A,B,C)= (S[g]<<<g) og A og (S[g]<<<g) og B og (S[q]<<<g)
og - operation choused by G
g - the value of a particular binary substring of G
F[T](A1,A2) = (S[{T{3..0}] <<< T{7..4}) \\
op[T{25..24}] A1
\\
op[T{27..26}] (S[T{11..8}] <<< T{15..12}) \\
op[T{29..28}] A2
\\
op[T{31..30}] (S[T{19..16}] <<< T{23..20});
Fox example having T=To=11 01 00 10 0010 1101 0101 1001 1011 1010
The function F will be:
F[To](A1,A2) = (S[10] <<< 11) * A1 + (S[9] <<< 5) xor A2 - (S[13] <<< 2);
I hope this will attract your attention, as i said before i will omit my
opinions about the significance and the properties of this approach, I will
be very glad if my idea is worth of your comment.
KB
http://eon.pmf.ukim.edu.mk/~kbajalc
http://kbajalc.tripod.com
PS: Here is a the source code realizing the described cipher just as
illustration.
int JV_Encrypt(void *block)
{
UL *BL, O[4], T, P;
UI R,i;
BL=(unsigned long *)block;
for(R=0;R<16;R++)
{
BL[0]+=BL[1]+BL[2]+BL[3]; T=BL[0];
P=JV_Key[(UI)(T%16)]; T>>=4; P=ROT32(P,T%16); T>>=4;
O[0]=BL[1];
O[1]=JV_Key[(UI)(T%16)]; T>>=4; O[1]=ROT32(O[1],T%16); T>>=4;
O[2]=BL[2];
O[3]=JV_Key[(UI)(T%16)]; T>>=4; O[3]=ROT32(O[3],T%16); T>>=4;
for(i=0;i<4;i++)
{
switch(T%4)
{
case 0: P+=O[i]; break;
case 1: P^=O[i]; break;
case 2: P=((P*O[i]) + P + O[i])%0xFFFFFFFBL; break;
case 3: P-=O[i]; break;
}
T>>=2;
}
BL[3]^=P;
T=BL[3]; BL[3]=BL[2]; BL[2]=BL[1]; BL[1]=BL[0]; BL[0]=T;
}
return 0;
}
------------------------------
Subject: Re: linear vs nonlinear
From: [EMAIL PROTECTED] (Leonard R. Budney)
Date: 05 May 2001 06:34:24 -0400
Mok-Kong Shen <[EMAIL PROTECTED]> writes:
> Tom St Denis wrote:
> >
> [snip]
>> Bingo. So a ring is like a field except not all elements are units
>> right?
>
> My knowledge is very humble, but I don't feel comfortable
> with what you say above...
I don't like it either, but he's basically right. Mainly, I don't like
calling invertible elements in a ring "units"; as a non-algebraist
whose orals were a long time ago, it makes me double-take to make sure
he doesn't mean "unit elements".
Plus, as you say, a field is a specialization of a ring. It's very wierd
to hear a ring defined as a "field which doesn't...".
So Tom, a ring is a set with two operations, usually denoted '+' and '*',
such that:
1. It's an Abelian group w.r.t. '+',
2. The '*' operation is associative, and
3. '+' and '*' are related by the usual distributive properties.
If for a ring R the '*' operator is commutative, then R is called a
'Commutative ring'. If R has a multiplicative unit element, then it's
called a 'Ring with a unit' or a 'Ring with 1', and the multiplicative
unit is written as '1', just as the additive unit is written as '0'.
A FIELD is a commutative ring with a unit, in which all elements (except
0) have a multiplicative inverse.
(Note that to some mathematicians, *all* rings are commutative, and to
some mathematicians, *all* rings are commutative and have a 1. To them,
a field is exactly a ring in which all elements are units, as Tom said.)
Len.
--
> What command do I use to make you denial of service package work?
You hit yourself in the head with a hammer.
-- Phrack Magazine
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list by posting to sci.crypt.
End of Cryptography-Digest Digest
******************************
