Cryptography-Digest Digest #322, Volume #14 Wed, 9 May 01 16:13:01 EDT
Contents:
Re: Cryptanalysis Question: Determing The Algorithm? (John Savard)
Re: Random and not random (Mok-Kong Shen)
Re: Cryptanalysis Question: Determing The Algorithm? (John Savard)
Re: Cryptanalysis Question: Determing The Algorithm? (John Savard)
Re: Best encrypting algoritme (Mok-Kong Shen)
RNG problem ("Dobs")
Encryption in JavaSCRIPT (DES or Blowfish) ("Super-Simon")
Re: Best, Strongest Algorithm (SCOTT19U.ZIP_GUY)
Re: Encryption in JavaSCRIPT (DES or Blowfish) (jlcooke)
Re: Random and not random (Bryan Olson)
Re: Best, Strongest Algorithm (jlcooke)
Re: A Question Regarding Backdoors (wtshaw)
Re: Best encrypting algoritme (wtshaw)
Re: ECC question ("Tom St Denis")
LaGrange Egg Hunt ("Tom St Denis")
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (John Savard)
Subject: Re: Cryptanalysis Question: Determing The Algorithm?
Date: Wed, 09 May 2001 17:26:17 GMT
On Sat, 21 Apr 2001 08:44:17 GMT, [EMAIL PROTECTED] (pjf) wrote, in
part:
>How does one determine what algorithm was used for a block of
>cyphertext (assume it's long enough to be cracked by known methods for
>any given algorithm, i.e. it's not a OTP), and does that even matter?
It could indeed be that if the algorithm is not known, the
cryptanalyst is out of luck.
It doesn't have to be the case, but that IS a very hard part of
cryptanalysis if the algorithm is decent.
Then why isn't everyone advised to keep their algorithms secret?
1) If you keep your algorithm secret, then you can't ask for help with
its design, to see if it is any good, or if you've made a mistake with
it. Not everyone has the resources of the NSA to design a good
algorithm.
2) Whether or not an algorithm can be cracked in practice if unknown
is a less useful thing in discussion about publicly known algorithms.
(One can always do a full attempt at cryptanalysis for each of the 100
most popular algorithms, so the fact that someone 'doesn't know'
you're using, say, SAFER instead of DES doesn't count.) If an
algorithm can't be broken even when it IS known, then everyone is
happy, and the issue is much less complicated.
John Savard
http://home.ecn.ab.ca/~jsavard/
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: Random and not random
Date: Wed, 09 May 2001 19:22:06 +0200
Bryan Olson wrote:
>
> Mok-Kong Shen wrote:
>
> > Before we argue more in details, let me challenge you to
> > show any flaws in the following simple purely formal
> > argument which plays an essential role in my recent
> > postings. I have modified the same in a post answering
> > James Felling a bit in order to render the content more
> > conspicous and in fact entirely trivial to be seen to
> > be logically universally true:
> >
> > Denoting by x and y typical elements of a set whose
> > elements can be compared, we have
> >
> > There is no max or min x (to choose) in the set <--->
> > Any x is equivalent to any y <--->
> > One is entirely free to choose an (arbitrary) x (without
> > obtaining a higher/lower value)
> >
> > If you can show any flaws then please kindly do so.
> > If, on the other hand, you accept the above as true, then
> > please apply it to your previous claim 'there is no best
> > or worst permutation to choose'
>
> I did not post anything so misleading. I wrote:
> | There is no best or worst permutation to choose; only good
> | and bad methods by which to make the choice.
>
> > and see what result
> > you'll get. It's a rather simple task, isn't it?
>
> To show the that it's nonsense is a simple task.
> There's no defined min and max among distinct permutations.
>
> But the real error is that you are still looking in the
> wrong place. It's the method of choosing the permutations
> that can destroy perfect secrecy, not any property of
> particular permutations. You had to deliberately chop my
> sentence in half to lead yourself so astray.
I am sorry to say that I am rather surprised by your
'apparent' (I hope unreal) inability to capture meanings
of stuffs (fairly carefully written by others) according
to the proper contexts that are prevailing. Note that
the words 'best' and 'worst' in your own claim imply
that there is a measure to evaluate the permutations
according to certain (your chosen) criteria (for your
application purposes etc.) so that these permutations
are correspondingly ordered according to that measure.
(How you choose to evaluate and hence order is your
business, not mine.) That means an operator '<' is
implicity defined for any pair of elements of the set
of permutations. (Saying that there is no 'best' or
'worst' permutation to choose can be alternatively
described by saying that there is an operator '=' that
always gives true for comparing the 'values' of any
pair of elements of the set.) Are you satisfied now
with these (in fact barely necessary detailed)
explanations? From that to the terms 'max' and 'min'
in my scheme of argumentation, which evidently should
correspond to your 'best' and 'worst', is certainly a
step that I shouldn't need to help you.
M. K. Shen
===========================
Was sich ueberhaupt sagen laesst, | Whatever can be said
laesst sich klar sagen; | can be clearly said;
und wovon man nicht reden kann, | and silence must be kept
darueber muss man schweigen. | on what one cannot tell.
|
Ludwig Wittgenstein | (a translation)
(1889 - 1951) |
------------------------------
From: [EMAIL PROTECTED] (John Savard)
Subject: Re: Cryptanalysis Question: Determing The Algorithm?
Date: Wed, 09 May 2001 17:28:36 GMT
On 22 Apr 2001 19:35:25 +1000, [EMAIL PROTECTED] (Matthew Kwan) wrote,
in part:
>When you say "powerful", do you mean capable of distinguishing between
>64-bit block ciphers? At first glance, this seems unlikely.
I agree. But if there was anything he could say, I doubt whether it
would be permitted to say it. Anyhow, trying to cryptanalyze for each
of the dozens of popular 64-bit block ciphers, assuming one had so
much known plaintext to do that without knowing the algorithm, is
certainly feasible for serious cryptanalysis.
John Savard
http://home.ecn.ab.ca/~jsavard/
------------------------------
From: [EMAIL PROTECTED] (John Savard)
Subject: Re: Cryptanalysis Question: Determing The Algorithm?
Date: Wed, 09 May 2001 17:32:37 GMT
On Wed, 09 May 2001 15:50:50 GMT, [EMAIL PROTECTED] (Bo
D�mstedt) wrote, in part:
quoting Douglas A. Gwyn:
>> Almost all actual systems have structural regularities, and uncovering
>> these is the first task in cryptodiagnosis.
>Right. But mostly not very easy...exept for small ciphers,
>like the simple substitution cipher, rotor machines, hand ciphers,
>etc.
True. But there is always the chance that the NSA can do this better
than the open community. Constructing a table for a block cipher from
a large amount of known plaintext and looking at it from original
perspectives might yield something.
John Savard
http://home.ecn.ab.ca/~jsavard/
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: Best encrypting algoritme
Date: Wed, 09 May 2001 19:42:14 +0200
Mark Wooding wrote:
>
> Mok-Kong Shen <[EMAIL PROTECTED]> wrote:
>
> > Given a block cipher (the decision to use such a one is mostly
> > 'fixed'), I believe that chaining is always a worthwhile additional
> > operation to be done, because it is fairly cheap computationally in
> > comparison to its benefit. However, I personally would prefer
> > non-linear chainings to the linear ones like CBC.
>
> Yes, some sort of chaining mode is necessary. ECB is clearly inadequate.
>
> However, I don't see the point of nonlinear chaining. We have a
> security proof which quantifies the strength of a block cipher in CBC
> mode (using a real-or-random security model) relative to the difficulty
> of distingishing the block cipher from a random function. This result
> is extremely satisfactory.
>
> Perhaps you can explain (a) how a nonlinear chaining mode will improve
> the security bounds achieved by CBC already, and (b) why it's worth the
> performance hit to do anything more complicated.
If you already have a proof that a certain chaining mode
gives you sufficient security, then it will be nonsense
to look for others. Using a non-linear combination instead
of a linear one in chaining serves in my view the same
purpose as elsewhere in encryption processing, where
nonlinear functions are used in preference to linear ones,
for it is in most situations (exceptions certainly could
be conceived) true that non-linearity presents greater
difficulty to the opponent than linearity. It is my
humble view that chaining as additional processing
operation is fairly cheap anyway, whether linear or
nonlinear, thus my personal preference. (I once suggested
using the sum of squares of plaintext and ciphertext
blocks.)
M. K. Shen
------------------------------
From: "Dobs" <[EMAIL PROTECTED]>
Subject: RNG problem
Date: Wed, 9 May 2001 20:08:01 +0200
I will try to explain my problem once again:
In Micali Schnorr generator the output is concatenation of
z1||z2||z3||.....||zl
where to obtain Zi we have to take k least significanct bits of Yi
and Yi=Xi-1^e mod n ( Yi can be number between 1 and n-1 so Yi can be
as well very small number)
What if Yi will be very small number ( lets say 8 bits long) and our
k=614.so we have to take 614 least significant bits of Yi
Should the output Zi have on the begining a lot of zeros and than bits from
our smal number ????????????
This sequence are supposed to be random and this O's on the begining seems
for me not realy random or I am wrong?
Could You please write me what to do to make this generator working correct.
Thanks
------------------------------
From: "Super-Simon" <[EMAIL PROTECTED]>
Crossposted-To: comp.lang.java.javascript,comp.lang.javascript
Subject: Encryption in JavaSCRIPT (DES or Blowfish)
Date: Wed, 9 May 2001 20:40:04 +0200
Hi,
Is it possible to encrypt and decrypt strings with DES or Blowfish in
JavaSCRIPT? If it is possible, where can I get more information????
With kind regards,
Simon
------------------------------
From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: Best, Strongest Algorithm
Date: 9 May 2001 18:38:48 GMT
[EMAIL PROTECTED] (Joseph Ashwood) wrote in <OXFxVM$1AHA.190@cpmsnbbsa07>:
>
>"SCOTT19U.ZIP_GUY" <[EMAIL PROTECTED]> wrote in message
>news:[EMAIL PROTECTED]...
>> Actually when it comes to crypto [in the United States] the NSA has
>> the
>final word.
>
>That is to some degree correct. They are in a position to exert undue
>force on the decision. However the simple fact that the selection of
>Rijndael was well-founded in the original goals of the AES selection
>process, and that all the finalists were asked barring their own
>submission which should win, they all (except the Rijndael team of
>course) agreed that Rijndael was the preferred choice. So while the NSA
>may have had the final word, that word coincided with the publicly
>ascertained desires of the contestants themselves, some of the finest
>cryptanalysts in the world.
Give me a break. Why don't you pat them on the back again. I
suspect the finest cryptananlysts are really in the NSA. The public
guys are only recognized because of the closed mutual admiration
society that they formed and want every one else to kiss there
asses. David Wagner for example couldn't even figure out how scott19u
works. And claimed his slide attack made mince meat of it. He was
wrong. Is he one in this class of finest cryptanalysts in
your view of the world he admitted he really never fully looked
at it. He can't even understand combilible source code.
>
>> [EMAIL PROTECTED] (Joseph Ashwood) wrote in
>> <envXT2m0AHA.274@cpmsnbbsa07>:
>
>[snip I said something about Rijndael]
>> The ciphers the NSA uses for the government are not open for
>> us to view. There is no reason to believe that Rijndael is any
>> where close to the secret ciphers the NSA uses.
>
>You'd be surprised how open they actually are. Not blatantly so, but we
>do have knowledge of key sizes, number of instructions, block sizes,
>cipher type, and sometimes knowledge of ancestry. Additionally we can
>gain more information by looking at the devices they purchase from the
>private sector for exactly these purposes. So no I don't know exactly
>what each cipher the government uses looks like, but I have a general
>idea that Rijndael is decent company for them, and quite likely their
>equal. The only concern that remains is the statement by Coppersmith
>during the AES process, stating that MARS was designed to protect
>against still classified forms of attack, attacks the other authors have
>no (public) knowledge of. I believe in the next few years this situation
>will change. We already have evidence that the public cryptanalytic
>activities are closing on the secret, and we have evidence that the
>attack on SKIPJACK was unknown to them, and that ECC took them by
>surprise. These indicate to me that the public knowledge is lacking
>mostly small portions of knowledge; bits and pieces from classified
>books, and the design of the current ciphers.
And you belive that Coppersmith has knowledge that MARS was
designed againest all forms of attack even those that the government
says are classied. If he said that and it was true and he had
knowledge of it being true. He would be dead by now. They do kill
people when the need arises. Oh it might be cancer or a car accident
but they do have secrets that they consider worth killing for.
I suspect SKIPJACK was designed weak. Don't forget it was for
the clipper chip to be used by all. It would be foolish to allow
a secure cipher for it. Just like vanilla RIJNDEAL has to be weak
the NSA would be foolish to allow a strong cipher for common people
to use.
>
>> Rijndael will
>> only be implimented in modes the NSA can safely break.
>
>There is no evidence of that, and significant evidence to the contrary.
>Strictly speaking if you believe that Timmermans BICOM is a secure
>implementation of Rijndael then by your judgement there is an
>implementation of Rijndael in a secure mode, which violates your initial
>statement.
You miss the point. BICOM is not and will not be recognized by
the crypto gods as an implimation of Rijndeal for various reasons.
One the people in charge don't seem to understand bijectiveity and
have even emailed me saying Matt could not do that. Second only
nobijective or weak counter mode types of chaining will be allowed.
Yes tell me counter mode will be great. I don't belive it.
If the AES thing is for real they should at least have a few
slow secure chaining modes for those paranoid about file encryption.
They don't out of fear that many may use more secure modes in email.
...
>> However that said I think one can foil the NSA by at least not
>> using weak modes and by using fully bijective versions of Rijndael
>> such as Matts BICOM.
>
>Earlier you said "Rijndael will only be implimented in modes the NSA can
>safely break" please feel free to correct whichever one you believe to
>be in error.
Let me state in a way you can understand. The NSA wants only
people to use RIJNDEAL in weak ways. They may provide a
list of programs that use RIJNDEAL in blessed ways. Matt has
used RIJNDEAL but it wont be blessed since its not as weakly
implimented as the NSA likes. He doesn't use nonbijective compression
like PGP. He doesn't use padding thats nonbijective. It will
encrypt any file. And any file can be uniquely decyrpted using
any key. This is not the kind of implimentaion the NSA wants
people to even know about. They don't even want people to
know about the concept. Since it allows for strong encryption
if uses in serial with another bijective encryption system.
It does add in the information helpful for breaking as other
methods do.
>
>> Instead of versions that will help the NSA
>> breaking system. One should never have a sytem where is possible that
>> one key is the only one that works. In Matts system at least all of
>> the keys point to a potinally file.
>
>And prove to me why use BICOM provides a situation where more than one
>key will produce a sensible decryption. That proof will be very hard, if
>not impossible, without breaking Rijndael in which case you'll have
>something much better to publish.
I am not sure what your driving out. Are you saying I can't find
an example of decyrpting some encrypted file with more than one
key and get to files that I might have actaully encrypted.
Becasue thats not to hard. Especailly if I use a different bijective
compressor in front of BICOM assuming your talking text files.
>
>> The NSA wants to be able to
>> read all encrypted messages.
>
>I doubt that the NSA doesn't have the man power to read all the
>messages, they will have to filter them somehow. Otherwise they would
>have to employ at least 50% of the world, since that would be 6 times
>the population of the US, I doubt they employ that many. So they must
>only want to read message that are of interest to them
>
I doubt they have time to look at every thing either. Its mostly
decrypt by machine and look for key words or phrases. I supose
depending on the political agenda being followed at the time different
messages will make it higher up the que to where some one might want
to look at it. For example some big contract we may lose to our
enemy the french. If we get good info on it we can help our own
corparation in there bids. Is not that the main use for the NSA
at this time?
David A. Scott
--
SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE "OLD VERSIOM"
http://www.jim.com/jamesd/Kong/scott19u.zip
My website http://members.nbci.com/ecil/index.htm
My crypto code http://radiusnet.net/crypto/archive/scott/
MY Compression Page http://members.nbci.com/ecil/compress.htm
**NOTE FOR EMAIL drop the roman "five" ***
Disclaimer:I am in no way responsible for any of the statements
made in the above text. For all I know I might be drugged or
something..
No I'm not paranoid. You all think I'm paranoid, don't you!
------------------------------
From: jlcooke <[EMAIL PROTECTED]>
Crossposted-To: comp.lang.java.javascript,comp.lang.javascript
Subject: Re: Encryption in JavaSCRIPT (DES or Blowfish)
Date: 9 May 2001 18:57:19 GMT
www.google.com
"des.js"
and press "I'm feeling lucky".
But you do not have the same control over memory in JS and you do in
compiled languages, so any data you encrypt is still susceptible to
localhost memory attacks by virii.
JLC
Super-Simon wrote:
>
> Hi,
>
> Is it possible to encrypt and decrypt strings with DES or Blowfish in
> JavaSCRIPT? If it is possible, where can I get more information????
>
> With kind regards,
>
> Simon
------------------------------
From: Bryan Olson <[EMAIL PROTECTED]>
Subject: Re: Random and not random
Date: Wed, 09 May 2001 12:18:05 -0700
Mok-Kong Shen wrote:
>
> Bryan Olson wrote:
[...]
> > I did not post anything so misleading. I wrote:
> > | There is no best or worst permutation to choose; only good
> > | and bad methods by which to make the choice.
> >
> > > and see what result
> > > you'll get. It's a rather simple task, isn't it?
> >
> > To show the that it's nonsense is a simple task.
> > There's no defined min and max among distinct permutations.
> >
> > But the real error is that you are still looking in the
> > wrong place. It's the method of choosing the permutations
> > that can destroy perfect secrecy, not any property of
> > particular permutations. You had to deliberately chop my
> > sentence in half to lead yourself so astray.
>
> I am sorry to say that I am rather surprised by your
> 'apparent' (I hope unreal) inability to capture meanings
> of stuffs (fairly carefully written by others) according
> to the proper contexts that are prevailing. Note that
> the words 'best' and 'worst' in your own claim imply
> that there is a measure to evaluate the permutations
> according to certain (your chosen) criteria (for your
> application purposes etc.)
False; I told you there is *no* best or worst permutation and
I told you the reason: good or bad is property of the way you
choose permutations, not the permutations themselves.
--Bryan
------------------------------
From: jlcooke <[EMAIL PROTECTED]>
Subject: Re: Best, Strongest Algorithm
Date: 9 May 2001 19:15:40 GMT
As an aside...
http://jlcooke.ca/aes/aes_fek.pdf
http://jlcooke.ca/aes/aes_fek.ps
and
http://jlcooke.ca/aes/aes_fek2.pdf
http://jlcooke.ca/aes/aes_fek2.ps
Algorithms using keys larger than the block sizes provide the existence
of the following relationship:
C = cipher text
P = plain text
K = key
If length(Ki) == 256 while length(Pi) == length(Ci) == 128 (as in
AES256)
There are 2^256 possible keys, and only 2^128 transformations from any
P_i to C_i.
This doesn't mean two keys K_m, K_n will operate in exactly the same
way, the key scheduling and round operations make sure of that. So I
agree with Scott in saying - basiclly - encryption really mangles data
and sometimes you can get something that looks sensible. Though this is
a rarity.
JLC
"SCOTT19U.ZIP_GUY" wrote:
> >And prove to me why use BICOM provides a situation where more than one
> >key will produce a sensible decryption. That proof will be very hard, if
> >not impossible, without breaking Rijndael in which case you'll have
> >something much better to publish.
>
> I am not sure what your driving out. Are you saying I can't find
> an example of decyrpting some encrypted file with more than one
> key and get to files that I might have actaully encrypted.
> Becasue thats not to hard. Especailly if I use a different bijective
> compressor in front of BICOM assuming your talking text files.
------------------------------
From: [EMAIL PROTECTED] (wtshaw)
Subject: Re: A Question Regarding Backdoors
Date: Wed, 09 May 2001 12:48:20 -0600
In article <[EMAIL PROTECTED]>, Mok-Kong Shen
<[EMAIL PROTECTED]> wrote:
> wtshaw wrote:
> >
> [snip]
> > It matters not that there might be a weakest link is a well nested
> > algorithm because all links need to be solved on their own merits.
>
> In another thread you also said that weaker algorithms
> can be compounded to produce new algorithms of any
> complexity. I guess that these statements of yours are
> true, though my poor knowledge doesn't allow me to
> contribute any non-trivial comments. Given the often
> seen scenario that even relative minor flaws or omissions
> would be quickly exposed, I continue nontheless to wonder
> that there have yet been no comments from experts to your
> claims which are from nature of general significance
> to crypto in view of the extent of their coverage
> (or critique 'provoking' to look from the other side)
> and hence their truth/false values should be established
> through extensive discussions in my humble view. (Or
> could I conclude from the silence that everyone in the
> group in fact perfectly agrees with what you said?)
>
> M. K. Shen
Any other comments out there?
There was a move to prohibit double encryption or multiple algorithms
being chained at one point, even have software that would not be allowed
to do this. The idea of algorithm headers is consistent with that
thinking, so that each layer can easily be stripped away. For real
encryptive security, such are counter productive and impossible to make
mandatory.
Define any algorithm as made of parts, even redundant processes, and there
is no multiple encryption necessary. Otherwise, anything with rounds
would have been defined as illegal.
--
Mother Nature always gets her revenge.
------------------------------
From: [EMAIL PROTECTED] (wtshaw)
Subject: Re: Best encrypting algoritme
Date: Wed, 09 May 2001 12:57:42 -0600
In article <[EMAIL PROTECTED]>, "John A. Malley"
<[EMAIL PROTECTED]> wrote:
> wtshaw wrote:
> [snip]
> >
> > An encryption algorithm is essentially a whole. Chaining modes are not
> > the only nor the best ways to add strength. As I said elsewhere, it is
> > true that the chaining mode must be solved together with what other steps
> > are involved, but these modes can be trivial complications in the scheme
> > of things. It would be better to not need them by selecting a better
> > single algorithm.
>
> That's an interesting suggestion - but can we do without chaining modes
> for block cipher algorithms? Isn't every block cipher used in ECB mode
> (the same as without any chaining modes) vulnerable to block replay?
For poorer algorithms, sure, and that is my point.
> Given enough known plaintext-ciphertext pairs won't a cryptanalyst begin
> to construct a "code-book" to aid further ciphertext analysis? And
> won't statistics of the plaintext show through (albeit only as can be
> discerned in terms of the occurrences of block-size chunks)? Even the
> very best (however that's defined) block cipher used in ECB mode has
> these drawbacks.
Back to one of my favorite topics, that inductive encryption is vastly
superior to symmetrical. If a block is reused, it is obvious in
symmetric.
>
> An All-Or-Nothing Transformation acting on the entire message is
> probably an example of a better single algorithm. Otherwise, there's
> good reason to use a block chaining mode with a block cipher.
>
> John A. Malley
> [EMAIL PROTECTED]
You present only two choices when their are more. I guess it is
all-or-nothing thinking to shoot right past a better option. The little
catch that was required was that block size remain consistent, but that is
a snake-in-the-grass requirement meant of limit the strength of
algorithms. Don't get me wrong, a 2X or more increase is not needed at
all, just a little headroom for terrific strength to be achieved.
--
Mother Nature always gets her revenge.
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: ECC question
Date: Wed, 09 May 2001 20:00:20 GMT
"Mike Rosing" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> Tom St Denis wrote:
> > Ack my brain exploded!!!!
>
> :-)
>
> > BTW why is it called the "j" invariant?
>
> I don't really know, but I can guess. The first person to publish
anything
> on it used the letter j and said it equalled a certain formula and that
this
> was interesting because it was an invariant. Since it's been called that
for
> over 200 years, you'd confuse a lot of people calling it anything else :-)
Probably the dudes name was "Jakob" or something...
Tom
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: LaGrange Egg Hunt
Date: Wed, 09 May 2001 20:07:24 GMT
I want to propose something that could be fun for the group and a good
learning experience for newbies etc.
The idea stems from Secret sharing techniques (LaGrange in particular) but
instead of handing the shadows out to the people we hide them on websites
(in text, pictures, sounds, puzzles) all around the net and give periodic
clues to where they are.
The basic idea is this.
1. Some people submit some thoughtful text via email to me and I paste them
together.
2. I make up a 256-bit key for RC4 and encrypt the text and post the
ciphertext.
3. I then make a (100,99) system where there will be 100 shadows and only
99 are required to solve it. I give one shadow to each participant to hide
on their website.
4. Then people start hunting them.
The goal of this project is to get the net working as a big team. There are
no prizes and no "first place" etc. Everyone will work together to figure
out the message. The other goals are to learn new ways to embed information
in websites not in an "encrypted" form but in a less obvious form like in an
image or something. By solving this puzzle the group can learn new
techniques and tricks, etc.
Each participant will be given a ascii message of the form "F(xxxxxxxx) =
yyyyyyyyyyy" where F is the 99 degree polynomial of the form
F(x) = (A_99)x^99 + (A_98)x^98 + ... + RC4_KEY
Where A_i is the 99 element random array which is never revealed. To solve
for the key one simply performs Gauss reduction and solves for all the A_i
values. Once they are known the RC4_KEY pops out and voila instead
decryption.
Is anyone interested in participating?
--
Tom St Denis
---
http://tomstdenis.home.dhs.org
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list by posting to sci.crypt.
End of Cryptography-Digest Digest
******************************
