Cryptography-Digest Digest #333, Volume #14 Fri, 11 May 01 09:13:01 EDT
Contents:
Re: Horst Feistel (John Savard)
Re: OAP-L3: "The absurd weakness." (John Savard)
Re: Micali-Schnorr pseudorandom bit generator ("Tom St Denis")
Re: Back to the Drawing Board (John Savard)
Re: TC15 Design (was Bitsliced Cipher) ("Tom St Denis")
Re: Micali-Schnorr pseudorandom bit generator (Charles Blair)
Re: Micali-Schnorr pseudorandom bit generator ("Tom St Denis")
Re: Crypto web-page (Mark Wooding)
Re: Encrypt/Decrypt, Digital Signature, Certificate authority, .. . . (kctang)
Information hiding in digital TV some thoughts and experiments. (Jan Panteltje)
Re: Information hiding in digital TV some thoughts and experiments. ("Tom St Denis")
Re: Crypto web-page ("Tom St Denis")
Re: Encrypt/Decrypt, Digital Signature, Certificate authority, .. . . ("Tom St
Denis")
Re: I am not complaining! (kctang)
Re: Horst Feistel (Jim Reeds)
Re: Are low exponents a problem with RSA? (DJohn37050)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (John Savard)
Subject: Re: Horst Feistel
Date: Fri, 11 May 2001 11:17:31 GMT
On Fri, 11 May 2001 13:51:36 +0400, "Vinokurov Andrey"
<[EMAIL PROTECTED]> wrote, in part:
>Is Horst Feistel native American or an immigrant?
He was born in Germany, and, awkwardly, did not become a citizen prior
to World War II, so he only had the opportunity to do so after that
war was over.
John Savard
http://home.ecn.ab.ca/~jsavard/
------------------------------
From: [EMAIL PROTECTED] (John Savard)
Crossposted-To: alt.hacker,talk.politics.crypto
Subject: Re: OAP-L3: "The absurd weakness."
Date: Fri, 11 May 2001 11:23:58 GMT
On Fri, 11 May 2001 02:46:20 -0700, Anthony Stephen Szopa
<[EMAIL PROTECTED]> wrote, in part:
>Anyone who would let you do their thinking for them deserves
>no better.
You would be *surprised* how few hours some people have in the day,
and how *many* ingenious enciphering programs, claimed to be secure,
are offered for their consideration.
Hence, generally, people have no choice but to rely, at least in part,
on the judgement and advice of others. Still, they do some thinking
for themselves - they evaluate who is more likely to be competent and
trustworthy before choosing which 'experts' to heed.
This is why, for example, Bruce Schneier's advice is so popular.
John Savard
http://home.ecn.ab.ca/~jsavard/
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Micali-Schnorr pseudorandom bit generator
Date: Fri, 11 May 2001 11:25:13 GMT
"Klaus Pommerening" <[EMAIL PROTECTED]> wrote in message
news:9dgh4e$chl$[EMAIL PROTECTED]...
> In <[EMAIL PROTECTED]> Benjamin Goldberg wrote:
> > Also, since the Micali-Schnorr generator seems to be similar in some
> > ways to the Blum-Blum-Schub generator, why not implement that, instead?
> > BBS is a much more well known and analysed PRNG.
> >
> Because Micali-Schnorr is faster by several orders of magnitude.
> BBS is notorious as the slowest PRNG of all times :-)
The BBS has nice properties though.
1. It's seekable.
2. You can use it to make key escrow systems pratical
3. It's provably as secure as factoring.
4. It's relatively simple to implement.
Tom
------------------------------
From: [EMAIL PROTECTED] (John Savard)
Subject: Re: Back to the Drawing Board
Date: Fri, 11 May 2001 11:26:55 GMT
On Mon, 07 May 2001 13:34:11 GMT, [EMAIL PROTECTED]
(John Savard) wrote, in part:
>Then I realized that to ensure that every bit went through each part
>of the cipher an equal number of times, the number of rounds would
>have to be:
>- a multiple of three, because of how the 96-bit part is enciphered
>- a multiple of four, because of how the 160-bit part works, and
>- a multiple of five, because of the way bits are exchanged between
>the two.
Actually, the 'three' and the 'five' can be replaced by eight, because
the bits spend time in both halves...or can they? Maybe it depends on
how the bit swap is arranged. This is an interesting question.
John Savard
http://home.ecn.ab.ca/~jsavard/
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: TC15 Design (was Bitsliced Cipher)
Date: Fri, 11 May 2001 11:32:56 GMT
I know it's only been a few days but I would appreciate feedback.
About 150 people have downloaded the source and related tools, no comments
(other than the binomial distribution stuff which lead me to design a better
LT).
I don't want to take credit for all the work here, this should be a group
effort.
Again why would anyone care?
1. It's fast (3.25 million blocks per second or 416 mbit/sec when compiled
by GCC on my Athlon 1.2ghz).
2. It can make the round keys on the fly (i.e usefull for hashing modes and
limited hardware).
3. It's simple, no huge tables or complex algebra
4. It's compact and well suited for hardware.
5. Afaik it's secure against diff and linear attacks as well other esoteric
attacks like slide and boomerang. I doubt interpolation attacks will work
since each output bit is not a linear combo of any other output bit (over
all inputs, i.e this is the Bit Independence Criterion or BIC).
Currently it supports 128-bit keys. I think it's possible to use larger
keys but I am not sure of the best method. I was thinking of running two
key schedules and just interleaving the round keys.
Any thoughts?
The sources are at
http://tomstdenis.home.dhs.org/tc15.c
http://tomstdenis.home.dhs.org/tc15_lta.c
http://tomstdenis.home.dhs.org/tc15_box.c
http://tomstdenis.home.dhs.org/tc15_test.c
Tom
------------------------------
Subject: Re: Micali-Schnorr pseudorandom bit generator
From: [EMAIL PROTECTED] (Charles Blair)
Date: Fri, 11 May 2001 11:51:49 GMT
"Tom St Denis" <[EMAIL PROTECTED]> writes:
>"Klaus Pommerening" <[EMAIL PROTECTED]> wrote in message
>news:9dgh4e$chl$[EMAIL PROTECTED]...
>> In <[EMAIL PROTECTED]> Benjamin Goldberg wrote:
>> > Also, since the Micali-Schnorr generator seems to be similar in some
>> > ways to the Blum-Blum-Schub generator, why not implement that, instead?
>> > BBS is a much more well known and analysed PRNG.
>> >
>> Because Micali-Schnorr is faster by several orders of magnitude.
>> BBS is notorious as the slowest PRNG of all times :-)
>The BBS has nice properties though.
>3. It's provably as secure as factoring.
I'm pretty sure the original paper related security to the problem
of whether a number was or was not a square modulo pq, which is a different
problem from factoring pq. It is well-known that factoring allows
square determination, but I did not know that the converse had been
shown.
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Micali-Schnorr pseudorandom bit generator
Date: Fri, 11 May 2001 11:57:41 GMT
"Charles Blair" <[EMAIL PROTECTED]> wrote in message
news:pnQK6.5666$[EMAIL PROTECTED]...
> "Tom St Denis" <[EMAIL PROTECTED]> writes:
>
>
> >"Klaus Pommerening" <[EMAIL PROTECTED]> wrote in message
> >news:9dgh4e$chl$[EMAIL PROTECTED]...
> >> In <[EMAIL PROTECTED]> Benjamin Goldberg wrote:
> >> > Also, since the Micali-Schnorr generator seems to be similar in some
> >> > ways to the Blum-Blum-Schub generator, why not implement that,
instead?
> >> > BBS is a much more well known and analysed PRNG.
> >> >
> >> Because Micali-Schnorr is faster by several orders of magnitude.
> >> BBS is notorious as the slowest PRNG of all times :-)
>
> >The BBS has nice properties though.
>
> >3. It's provably as secure as factoring.
>
> I'm pretty sure the original paper related security to the problem
> of whether a number was or was not a square modulo pq, which is a
different
> problem from factoring pq. It is well-known that factoring allows
> square determination, but I did not know that the converse had been
> shown.
Finding square roots is the same as factoring.
Modulo a blum integer any quadratic residue will have four roots, x, -x, y
and -y. x != y, thus x^2 = y^2 will lead to a factorization since gcd(x -
y, pq) will be p or q.
Simple proof.
Tom
------------------------------
From: [EMAIL PROTECTED] (Mark Wooding)
Subject: Re: Crypto web-page
Date: 11 May 2001 12:22:48 GMT
jlcooke <[EMAIL PROTECTED]> wrote:
> I think you'd be hard pressed to find a successful example of this at
> a global scale Tom. I'm getting flash-backs of a news headline:
> "VeriSign falsely issues two Microsoft certificates". And how do you
> test the authenticity of the amazon.com cert? With the CA cert you
> downloaded in Netscape? Chicken and Egg.
So I should just trust the certificates I find in my copy of Netscape?
Yeah, right.
-- [mdw]
------------------------------
From: kctang <[EMAIL PROTECTED]>
Crossposted-To: hk.comp,hk.comp.software
Subject: Re: Encrypt/Decrypt, Digital Signature, Certificate authority, .. . .
Date: Fri, 11 May 2001 20:22:53 +0800
==============5EDAB9C31CB53814CA419AA5
Content-Type: text/plain; charset=big5
Content-Transfer-Encoding: 7bit
Dear Forum,
Encrypt/Decrypt, Digital Signature, Certificate authority, .. . .
Don't study anything more than that!
Turn to "undergraduate" computer science, or even "studies",
courses would be much better.
Installing and making existing products working is the most
important of all.
Probably downloading programs, writing the interfaces, and
"make them working", to a substantial degree, would be
considered as high-technology.
However, I must stress that I don't know much, and to what
extent Hong Kong People are really developing high-technology
software or hardware products. (I know an example and I can tell
you later.)
Many huge companies are always complaining that experienced and
high-tech computer professionals are missing here, despite that
Hong Kong (just 500 square KM ?) has eight Universities now.
They are moving back to mainland China several tens of km away
from Hong Kong to set up offices for software "research" and
"development".
I am always curious about what kinds of computer professionals
they are looking for. I, myself, don't understand! (But please
note that this might represent huge business opportunities for
somebody here in the forum.)
Yours, kctang
==============5EDAB9C31CB53814CA419AA5
Content-Type: text/html; charset=big5
Content-Transfer-Encoding: 7bit
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<tt>Dear Forum,</tt><tt></tt>
<p><tt> Encrypt/Decrypt, Digital Signature, Certificate
authority, .. . .</tt><tt></tt>
<p><tt>Don't study anything more than that!</tt><tt></tt>
<p><tt>Turn to "undergraduate" computer science, or even "studies",</tt>
<br><tt>courses would be much better.</tt><tt></tt>
<p><tt>Installing and making existing products working is the most</tt>
<br><tt>important of all.</tt><tt></tt>
<p><tt>Probably downloading programs, writing the interfaces, and</tt>
<br><tt>"make them working", to a substantial degree, would be</tt>
<br><tt>considered as high-technology.</tt><tt></tt>
<p><tt>However, I must stress that I don't know much, and to what</tt>
<br><tt>extent Hong Kong People are really developing high-technology</tt>
<br><tt>software or hardware products. (I know an example and I can tell</tt>
<br><tt>you later.)</tt><tt></tt>
<p><tt>Many huge companies are always complaining that experienced and</tt>
<br><tt>high-tech computer professionals are missing here, despite that</tt>
<br><tt>Hong Kong (just 500 square KM ?) has eight Universities now.</tt>
<br><tt>They are moving back to mainland China several tens of km away</tt>
<br><tt>from Hong Kong to set up offices for software "research" and</tt>
<br><tt>"development".</tt><tt></tt>
<p><tt>I am always curious about what kinds of computer professionals</tt>
<br><tt>they are looking for. I, myself, don't understand! (But please</tt>
<br><tt>note that this might represent </tt><b><font size=+1>huge business
opportunities</font></b><tt> for</tt>
<br><tt>somebody here in the forum.)</tt><tt></tt>
<p><tt>Yours, kctang</tt>
<br><tt></tt> </html>
==============5EDAB9C31CB53814CA419AA5==
------------------------------
From: [EMAIL PROTECTED] (Jan Panteltje)
Subject: Information hiding in digital TV some thoughts and experiments.
Date: Fri, 11 May 2001 12:20:26 GMT
Digital TV transmissions are now common in Europe.
With a small dish one can receive 400 or more stations, some encrypted, some
not.
Recently I have been involved with processing this digital information,
in my case mainly to write software that allows one to add / edit subtitles to
existing programs.
In experimenting I discovered the digital transport stream as used in DTV is a
place with a vast potential to hide any info you like in any way you like,
with a huge bandwidth too.
For example small changes (say the last few bits) in the PTS (presentation
time stamp, used in PES (program elementary stream) packets) (and perhaps even
more so the DTS (decoding timestamp) ) go unnoticed by the user (well unless
he has extraordinary capabilities, and dts would not even affect the picture
at all).
These timestamps are derived from the 27 MHz reference clock in the decoder,
which is divided by 300, so a 90 kHz reference, the PTS increments 3600 ticks
for each frame.
And PTS is at least present in the data stream every 600 mS (or more frequent
in ATSC etc).
These timestamps are also present (and part of) the MPEG2 data stream.
So you could use changes in that to encode messages in a MPEG2 stream too.
Of cause there are a LOT of other fields that can be 'altered' or some
reserved ones that could be used.
I personally think that this combined with a good encryption will make it very
difficult for any government to monitor for hidden messages,
For example a hostile government with its own transponder on a satellite would
even be able to detonate locally stored weapons that way, with a very high
reliability, and without any chance of detection.
Put a nuclear bomb with a connection to a dish in any city.
Satellite dishes are very common.
Of cause simply sending information to local spies would be very easy too.
Al the spy needs is a satellite dish, PC and a digital TV card, and the right
software. It is so secure I can hardly believe it.
This mainly because the impossibility to analyze all the TV channels for any
data, let alone do a brute force or whatever else attack on each possibility
in each channel, after all they would not publish when and how the encrypted
data was transmitted, and which encryption method (or part thereof) was used.
Also, in times of 'disaster' the telephone system may faill, but
it is really hard to kill a satellite, especially when the other countries
also use the same transponders, that could cause extra political problems.
The Internet for example can be cut by law enforcement on the local ISP's,
in a country in a state of war, but to find satellite dishes and remove these,
would be a whole different matter.
Anyways these were just some thoughts after some initial experiments here...
Regards
Jan
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Information hiding in digital TV some thoughts and experiments.
Date: Fri, 11 May 2001 12:29:26 GMT
"Jan Panteltje" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> Digital TV transmissions are now common in Europe.
> With a small dish one can receive 400 or more stations, some encrypted,
some
> not.
> Recently I have been involved with processing this digital information,
> in my case mainly to write software that allows one to add / edit
subtitles to
> existing programs.
> In experimenting I discovered the digital transport stream as used in DTV
is a
> place with a vast potential to hide any info you like in any way you like,
> with a huge bandwidth too.
>
> For example small changes (say the last few bits) in the PTS (presentation
> time stamp, used in PES (program elementary stream) packets) (and perhaps
even
> more so the DTS (decoding timestamp) ) go unnoticed by the user (well
unless
> he has extraordinary capabilities, and dts would not even affect the
picture
> at all).
> These timestamps are derived from the 27 MHz reference clock in the
decoder,
> which is divided by 300, so a 90 kHz reference, the PTS increments 3600
ticks
> for each frame.
> And PTS is at least present in the data stream every 600 mS (or more
frequent
> in ATSC etc).
> These timestamps are also present (and part of) the MPEG2 data stream.
> So you could use changes in that to encode messages in a MPEG2 stream too.
> Of cause there are a LOT of other fields that can be 'altered' or some
> reserved ones that could be used.
> I personally think that this combined with a good encryption will make it
very
> difficult for any government to monitor for hidden messages,
> For example a hostile government with its own transponder on a satellite
would
> even be able to detonate locally stored weapons that way, with a very high
> reliability, and without any chance of detection.
> Put a nuclear bomb with a connection to a dish in any city.
> Satellite dishes are very common.
> Of cause simply sending information to local spies would be very easy too.
> Al the spy needs is a satellite dish, PC and a digital TV card, and the
right
> software. It is so secure I can hardly believe it.
> This mainly because the impossibility to analyze all the TV channels for
any
> data, let alone do a brute force or whatever else attack on each
possibility
> in each channel, after all they would not publish when and how the
encrypted
> data was transmitted, and which encryption method (or part thereof) was
used.
> Also, in times of 'disaster' the telephone system may faill, but
> it is really hard to kill a satellite, especially when the other countries
> also use the same transponders, that could cause extra political problems.
> The Internet for example can be cut by law enforcement on the local ISP's,
> in a country in a state of war, but to find satellite dishes and remove
these,
> would be a whole different matter.
> Anyways these were just some thoughts after some initial experiments
here...
> Regards
> Jan
Interesting. Isn't that similar to TV and the VLO (whatever it's called)
the info between frames that is sent to give things like program names and
early WebCast TV (down only)?
Tom
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Crypto web-page
Date: Fri, 11 May 2001 12:30:55 GMT
"Mark Wooding" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> jlcooke <[EMAIL PROTECTED]> wrote:
>
> > I think you'd be hard pressed to find a successful example of this at
> > a global scale Tom. I'm getting flash-backs of a news headline:
> > "VeriSign falsely issues two Microsoft certificates". And how do you
> > test the authenticity of the amazon.com cert? With the CA cert you
> > downloaded in Netscape? Chicken and Egg.
>
> So I should just trust the certificates I find in my copy of Netscape?
> Yeah, right.
Generally in the end you have to just assume no one is going to exploit you.
Our society is not secure at all. For example, you assume that when you use
a credit card in the store the 17yr old clerk won't copy your number down
and use it later that night to buy 100 books at Amazon.
I wouldn't say "the technology is lacking" I would say "the people are
lacking".
Tom
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Crossposted-To: hk.comp,hk.comp.software
Subject: Re: Encrypt/Decrypt, Digital Signature, Certificate authority, .. . .
Date: Fri, 11 May 2001 12:33:22 GMT
Please stop posting in HTML here.
You obviously are not a cryptographer since you claim that "studying" is a
waste of time. I agree that one must have practical knowledge e.g. how to
implement the crypto but to simply state that someone who reads AC is
"wasting their time" is bogus.
Not only that but why are you talking about hong kong? I don't remember
someone posting complaints about hong kong in this forum so to whom are you
replying?
Tom
=========
"kctang" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
Dear Forum,
Encrypt/Decrypt, Digital Signature, Certificate authority, .. . .
Don't study anything more than that!
Turn to "undergraduate" computer science, or even "studies",
courses would be much better.
Installing and making existing products working is the most
important of all.
Probably downloading programs, writing the interfaces, and
"make them working", to a substantial degree, would be
considered as high-technology.
However, I must stress that I don't know much, and to what
extent Hong Kong People are really developing high-technology
software or hardware products. (I know an example and I can tell
you later.)
Many huge companies are always complaining that experienced and
high-tech computer professionals are missing here, despite that
Hong Kong (just 500 square KM ?) has eight Universities now.
They are moving back to mainland China several tens of km away
from Hong Kong to set up offices for software "research" and
"development".
I am always curious about what kinds of computer professionals
they are looking for. I, myself, don't understand! (But please
note that this might represent huge business opportunities for
somebody here in the forum.)
Yours, kctang
------------------------------
From: kctang <[EMAIL PROTECTED]>
Crossposted-To: hk.comp,hk.comp.software
Subject: Re: I am not complaining!
Date: Fri, 11 May 2001 20:44:00 +0800
Tom St Denis wrote:
> Please stop posting in HTML here.
------------------------------
From: [EMAIL PROTECTED] (Jim Reeds)
Subject: Re: Horst Feistel
Date: Fri, 11 May 2001 12:54:23 GMT
In article <[EMAIL PROTECTED]>, Paul Rubin <[EMAIL PROTECTED]>
writes:
|>
|> FYE-stell. But it's a German name, not American.
Most Americans pronounce it with the stress on the second
syllable (fai-STELL), even though in German it's correct to put
the stress on the first syllable, as Paul indicates. I don't
know which syllable HF himself stressed.
--
Jim Reeds, AT&T Labs - Research
Shannon Laboratory, Room C229, Building 103
180 Park Avenue, Florham Park, NJ 07932-0971, USA
[EMAIL PROTECTED], phone: +1 973 360 8414, fax: +1 973 360 8178
------------------------------
From: [EMAIL PROTECTED] (DJohn37050)
Date: 11 May 2001 13:04:06 GMT
Subject: Re: Are low exponents a problem with RSA?
Use of a larger RSA public exponent might help to protect against the risk of
an RNG failure. For example, if the RNG is STUCK at a constant value, this it
is NO value at all and the OAEP or whatever formatted messages will be related,
which is a concern. If the "random" output is related, then it depends on the
details.
Note that this is not just a theoritical possibility, apparently the Russian
VERONA transcripts were using a OTP and somehow the OTP was caused to repeat or
the RNG repeat or something.
Don Johnson
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list by posting to sci.crypt.
End of Cryptography-Digest Digest
******************************
