Cryptography-Digest Digest #347, Volume #14 Sun, 13 May 01 10:13:01 EDT
Contents:
Re: PRNG question from newbie (Paul Crowley)
Re: Best, Strongest Algorithm (Tim Tyler)
Re: DES Crypto Myth?? ("Sam Simpson")
Re: DES Crypto Myth?? (Mok-Kong Shen)
Re: Secure 'talk'? ("Harris Georgiou")
Re: DES Crypto Myth?? (Mok-Kong Shen)
Re: RSA signing with public e = 3 ("Peter Kooiman")
Re: DES Crypto Myth?? ("Tom St Denis")
Re: RSA signing with public e = 3 ("Tom St Denis")
Re: Secure 'talk'? ("Tom St Denis")
Re: DES Crypto Myth?? ("Tom St Denis")
About DES or AES ? (Cheng-Fen)
Re: About DES or AES ? ("Tom St Denis")
Re: Quasi Functions, a way to design Maximum Secure Cipher (rep to Tom) ("Kostadin
Bajalcaliev")
Re: Quasi Functions, a way to design Maximum Secure Cipher (rep to Tom) ("Tom St
Denis")
Quasi Functions, a way to design Maximum Secure Cipher (rep to Scott) ("Kostadin
Bajalcaliev")
Quasi Functions, a way to design Maximum Secure Cipher (rep To MARK) ("Kostadin
Bajalcaliev")
Re: About DES or AES ? (Erwann ABALEA)
----------------------------------------------------------------------------
Subject: Re: PRNG question from newbie
From: Paul Crowley <[EMAIL PROTECTED]>
Date: Sun, 13 May 2001 05:35:09 GMT
"Scott Fluhrer" <[EMAIL PROTECTED]> writes:
> John Myre <[EMAIL PROTECTED]> wrote in message
> news:[EMAIL PROTECTED]...
> > The creators of Rijndael (*) have said that "PRNG" and "hash
> > function" ought to be considered as the same idea, they just
> > have different input and output sizes. In support of this
> > opinion, they have created an algorithm, Panama, that can be
> > used both ways. (I don't know how far they've gone with this
> > line of thought, or if they still support the idea.)
> You are aware that Panama was broken as a hash function (but not as a stream
> cipher) at FSE2001 by Rijmen, Rompay, Preneel and Vandewalle.
The good news is that this attack arose as part of work towards
creating a Panama variant that draws ideas from Rijndael, so we should
soon see another similar primitive. I definitely think they have the
right idea.
--
__ Paul Crowley
\/ o\ [EMAIL PROTECTED]
/\__/ http://www.cluefactory.org.uk/paul/
"Conservation of angular momentum makes the world go around" - John Clark
------------------------------
From: Tim Tyler <[EMAIL PROTECTED]>
Subject: Re: Best, Strongest Algorithm
Reply-To: [EMAIL PROTECTED]
Date: Sun, 13 May 2001 08:19:43 GMT
jlcooke <[EMAIL PROTECTED]> wrote:
: So it's in the their best interests to choose the best block cipher to
: assure everyone they can be trusted [...]
Use of PKC is not the only method used for exchanging keys.
Anyway, since when do government spy agencies care whether they are
trusted by the general public? For many years the general public was
hardly aware of their existence.
It's in the best interests of spy agencies that strong crypto of any kind
is not widely publicly used.
--
__________ http://rockz.co.uk/ http://alife.co.uk/ http://hex.org.uk/
|im |yler http://atoms.org.uk/ http://mandala.co.uk/ [EMAIL PROTECTED]
------------------------------
From: "Sam Simpson" <[EMAIL PROTECTED]>
Subject: Re: DES Crypto Myth??
Date: Sun, 13 May 2001 10:09:25 +0100
Don's right: According to Levy's book Crypto (best account of DES
development that I've seen), the IBM researchers developed an attack against
some SBoxes called the "T attack" (rediscovered as the Differential Attack)
so they then proposed SBoxes that were resistant to this attack.
This is one of the reasons that IBM were prevented from disclosing the
design principles of DES: the NSA didn't want details of the T Attack (which
they had discovered previously!) to be published.
I think it's interesting to note that the differential attack was discovered
and published publicly in 1994, was found by IBM 20 years previously and was
known to the NSA prior to that.
Is the public crypto community generally 20 years behind the NSA's
abilities? Who can tell..........
--
Regards,
Sam
http://www.scramdisk.clara.net/
DJohn37050 <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> AFAIK, the S boxes were designed to meet certain criteria and many random
ones
> were tested against the criteria. This was all done by IBM.
> Don Johnson
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: DES Crypto Myth??
Date: Sun, 13 May 2001 11:31:51 +0200
[EMAIL PROTECTED] wrote:
>
> David Wagner wrote:
> >
> > Who cares? The properties of the S-boxes on their own don't matter
> > diddly squat -- it's the properties of the DES cipher as a whole that
> > matter.
>
> Now that's the best news I've heard all day! Now I can quit drudging
> through this bent function, Hadamard matrix, and SAC crap and just
> throw in a random S-box and crank the number of rounds up to 32 or so.
> Whew! I knew it wasn't as difficult as everyone was making out.
I suppose that it is at least plausible that using key-
dependent random S-boxes and a higher number of rounds
would be as good as carefully designed fixed S-boxes. But
one wants to minimize the number of rounds, hence one has
to optimize the S-boxes.
M. K. Shen
------------------------------
From: "Harris Georgiou" <[EMAIL PROTECTED]>
Subject: Re: Secure 'talk'?
Date: Sun, 13 May 2001 12:46:46 +0300
� Paul Rubin <[EMAIL PROTECTED]> ������ ��� ������ ���������:
[EMAIL PROTECTED]
> "Harris Georgiou" <[EMAIL PROTECTED]> writes:
> > Given the key size (64-bit) and the mutable keys/functions, the question
is
> > how easy it is for someone to tap into the session and recover all
plaintext
> > message traffic (after some trials)?...
> >
> > PS: Random function is of standard form: X(n+1)=[a*X(n)+c]mod[m] and
> > en/decryption functions are all binary (combinations of 64-bit ROLs,
XORs,
>
> It sounds like this encryption scheme is no good and I wouldn't trust
> its security for anything except very casual attackers. Replace it
> with good cryptography and you'll have something. But why not use an
> existing program, like ytalk?
Never mind that, I'm just thinking how "casual" this attacker would be and
how "trivial" should any successful attack be. After all, why not use a
trully secure networking layer like VPN (PGP) or SSL? I cannot think of an
easy way to discover the initial key from just a few ciphertexts, not while
the key is 64-bit and mutable. Any ideas?
--
Harris
- 'Malo e lelei ki he pongipongi!'
------------------------------
From: Mok-Kong Shen <[EMAIL PROTECTED]>
Subject: Re: DES Crypto Myth??
Date: Sun, 13 May 2001 12:11:03 +0200
Sam Simpson wrote:
>
[snip]
> I think it's interesting to note that the differential attack was discovered
> and published publicly in 1994, was found by IBM 20 years previously and was
> known to the NSA prior to that.
>
> Is the public crypto community generally 20 years behind the NSA's
> abilities? Who can tell..........
Like in math, you can't extrapolate with a single data
point. Guarding secret technologies, e.g. industrial
manufacturing knowledges, always bear immense fruits.
On the other hand, the public crypto community does have
the advantage of having a pool of academic researchers
which is presumably significantly larger in size than
that of the experts employed in any single secret agency.
I am optimistic that the academics are catching up at an
increased speed so that the leading-edge of the agencies
would become insignificant in the near future.
It is on the other hand a good conservatism to always
assume that one's opponent is much more capable than
oneself so that one would constantly keep a high margin
of safety in securing one's communications, even if that
were in fact not needed.
M. K. Shen
------------------------------
From: "Peter Kooiman" <[EMAIL PROTECTED]>
Subject: Re: RSA signing with public e = 3
Date: Sun, 13 May 2001 12:22:58 +0200
> There are attacks if someone just blindly encrypts something with their
> private key. A true signing is:
> S = ( HASH(data) ) ^ d MOD K
>
> Otherwise,
> S = ( M ^ e MOD N ) ^ d MOD K
> can be used to directly find d.
Could you elaborate on that? I don�t quite see how one would go about
finding d..
Peter
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: DES Crypto Myth??
Date: Sun, 13 May 2001 11:03:33 GMT
<[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED]...
> Simon Johnson wrote:
> > >
> > > const unsigned sbox[1][64] = {
> > > { 3, 1, 2, 5, 7, 6, 4, 12, 15, 11, 8, 10, 13, 9, 0, 14,
> > > 15, 7, 11, 3, 2, 13, 14, 8, 12, 5, 4, 10, 9, 0, 6, 1,
> > > 4, 14, 15, 10, 13, 8, 0, 3, 5, 11, 6, 2, 9, 12, 7, 1,
> > > 3, 14, 0, 13, 1, 10, 11, 9, 5, 15, 12, 6, 2, 8, 7, 4 } };
> > >
> > > (lpmax is 10/64, dpmax is 12/64)
> > >
> > > But this sbox would probably suck in DES since it doesn't follow the
> > > required design.
> > >
> > > So I would believe that they knew about the attacks.
> > >
> > > Tom
> >
> > What Tom is touching on, was that the DES team knew about Differential
> > Cryptanalysis... but they did not know about linear cryptanalysis... so
> > however your robustness quantity is defined it probably includes
resistance
> > to linear cryptanalysis which would explain how it strayed so far from
the
> > optimal.
> >
> > Simon.
>
> I pretty sure the robustness calculation didn't take linear
> cryptanalysis
> into account. The equation is
> Robustness R = (1-N/2^n)(1-L/2^n)
> where N = non-zero entries in first column of diff. distribution table
> L = largest non-zero value in diff. distribution table
This equation is out of date. Let's suppose you have a perfect 3x3 sbox
(i.e dpmax and lpmax of 2/8) this will get me a robustness of (1-0/8)(1-2/8)
= 0.75. Which is nowhere close to a useful value since it's perfect....
for bijective functions the correct calc for robusness is
R = (1-N/2^n)(1 - (L-2)/2^n)
or simply
R = 1 - (L-2)/2^n
> The non-zero entries in the first column affects the probability of zero
> output
> differential with non-zero input differential and the largest non-zero
> value
> gives a high probability output differential.
>
> I don't know anything about linear cryptanalysis so I can't say for
> sure.
For linear cryptanalysis you make a LAT (Linear Approximation Table) where
you check to see how often or not a given approximation on the input leads
to a particular approximation on the output. For example
Walsh-Transform Output:
0 0 0 0 0 0 0 0
0 0 -2 2 0 0 -2 -2
0 2 -2 0 0 2 2 0
0 2 0 2 0 -2 0 2
0 0 0 0 2 2 -2 2
0 0 2 2 -2 2 0 0
0 -2 -2 0 -2 0 0 2
0 2 0 -2 -2 0 -2 0
Which tells me that (for example) the first output bit is a linear function
of all 3 inputs with a prob of 0.5 + 2/8 = 0.75 (look at the bottom row
which would be 7 = 111_2 and the second column in that row). This 3x3
bijection is maximally nonlinear (i.e for a non-bent function). For a 4x4
the best you can do is 4/16=1/4, for a 8x8 the best is 16/256 = 1/16. The
best non-bent function you can make will have a min bias of 2^(n/2) / 2^n.
My sboxgen program makes both LAT and xor-pair tables... the walsh transform
is easy todo if you want it's simply
LAT(a,b) = SUM[0..2^n - 1] of (-1)^( (x dot a) + (F(x) dot b) )
Where <a,b> are the LAT pair (a is the input approx and b is the output
approx), the dot is a binary vector dot product (typically done via an AND)
and the '+' takes the vectors and reduces them to their parities then sums
those...
Essentially you do a AND operation 'x AND a' then get that parity 'x =
par[x]', then 'y = F(x) AND b, y = par[y]' ... finally 'z = x+y' and that
determines the exponent.
Tom
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: RSA signing with public e = 3
Date: Sun, 13 May 2001 11:16:39 GMT
"Peter Kooiman" <[EMAIL PROTECTED]> wrote in message
news:3afe60b8$[EMAIL PROTECTED]...
> > There are attacks if someone just blindly encrypts something with their
> > private key. A true signing is:
> > S = ( HASH(data) ) ^ d MOD K
> >
> > Otherwise,
> > S = ( M ^ e MOD N ) ^ d MOD K
> > can be used to directly find d.
>
> Could you elaborate on that? I don�t quite see how one would go about
> finding d..
If I get to pick the modulus they use I can find d easily. But the thing is
in real RSA the modulus is key specific...
i.e let's suppose K=3, then G^d mod K, gets me d mod 3-2 = d mod 2. repeat
as required. (i.e CRT).
I dunno where K/N come from in the OPs message though
Tom
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Secure 'talk'?
Date: Sun, 13 May 2001 11:18:14 GMT
"Harris Georgiou" <[EMAIL PROTECTED]> wrote in message
news:9dll62$26vb$[EMAIL PROTECTED]...
>
> � Paul Rubin <[EMAIL PROTECTED]> ������ ��� ������ ���������:
> [EMAIL PROTECTED]
> > "Harris Georgiou" <[EMAIL PROTECTED]> writes:
> > > Given the key size (64-bit) and the mutable keys/functions, the
question
> is
> > > how easy it is for someone to tap into the session and recover all
> plaintext
> > > message traffic (after some trials)?...
> > >
> > > PS: Random function is of standard form: X(n+1)=[a*X(n)+c]mod[m] and
> > > en/decryption functions are all binary (combinations of 64-bit ROLs,
> XORs,
> >
> > It sounds like this encryption scheme is no good and I wouldn't trust
> > its security for anything except very casual attackers. Replace it
> > with good cryptography and you'll have something. But why not use an
> > existing program, like ytalk?
>
> Never mind that, I'm just thinking how "casual" this attacker would be and
> how "trivial" should any successful attack be. After all, why not use a
> trully secure networking layer like VPN (PGP) or SSL? I cannot think of an
> easy way to discover the initial key from just a few ciphertexts, not
while
> the key is 64-bit and mutable. Any ideas?
That's not entirely scientific. "mutable" technically means "able to be
silenced".
Just randomly inventing your own algorithm is a "bad idea (tm)".
Tom
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: DES Crypto Myth??
Date: Sun, 13 May 2001 11:19:57 GMT
"Mok-Kong Shen" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
>
>
> [EMAIL PROTECTED] wrote:
> >
> > David Wagner wrote:
> > >
> > > Who cares? The properties of the S-boxes on their own don't matter
> > > diddly squat -- it's the properties of the DES cipher as a whole that
> > > matter.
> >
> > Now that's the best news I've heard all day! Now I can quit drudging
> > through this bent function, Hadamard matrix, and SAC crap and just
> > throw in a random S-box and crank the number of rounds up to 32 or so.
> > Whew! I knew it wasn't as difficult as everyone was making out.
>
> I suppose that it is at least plausible that using key-
> dependent random S-boxes and a higher number of rounds
> would be as good as carefully designed fixed S-boxes. But
> one wants to minimize the number of rounds, hence one has
> to optimize the S-boxes.
Bingo. Schneier said it well in AC2. [paraphrasing now since AC2 is all
the way on the bookshelf...] "Anyone can design a secure block cipher with
128 rounds and a 512-bit key ...".
Specially in DES which requires very specific sboxes. In something like
GOST you are given a bit more freedom but the sboxes one picks should be
nonlinear and have a high avalanche (follow SAC).etc...
Tom
------------------------------
From: Cheng-Fen <[EMAIL PROTECTED]>
Subject: About DES or AES ?
Date: Sun, 13 May 2001 11:52:19 +0000 (UTC)
How can I tell a high school student
or freshment that
AES or DES is a permutation?
Thx!
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: About DES or AES ?
Date: Sun, 13 May 2001 11:55:22 GMT
"Cheng-Fen" <[EMAIL PROTECTED]> wrote in message
news:9dlshj$p9o$[EMAIL PROTECTED]...
>
> How can I tell a high school student
> or freshment that
> AES or DES is a permutation?
Simple. They both have inverses. All invertable functions are
permutations.
Tom
------------------------------
From: "Kostadin Bajalcaliev" <[EMAIL PROTECTED]>
Subject: Re: Quasi Functions, a way to design Maximum Secure Cipher (rep to Tom)
Date: Sun, 13 May 2001 14:10:05 +0200
>"Polymorphic" just means many shapes doesn't it? How does your cipher
>change shape?
YES IT IS
>Blah blah blah. Why would the laymen (like me) give a rats ass? You
should
>really post your claims/results/findings.
PLEASE READ THE THESIS
>For example when I posted my nifty toy block cipher I also posted "one
would
>
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Quasi Functions, a way to design Maximum Secure Cipher (rep to Tom)
Date: Sun, 13 May 2001 12:33:11 GMT
"Kostadin Bajalcaliev" <[EMAIL PROTECTED]> wrote in message
news:3afe79a7$[EMAIL PROTECTED]...
> >"Polymorphic" just means many shapes doesn't it? How does your cipher
> >change shape?
>
> YES IT IS
>
> >Blah blah blah. Why would the laymen (like me) give a rats ass? You
> should
> >really post your claims/results/findings.
>
> PLEASE READ THE THESIS
GIMME THE ABSTRACT OF THE THESIS FIRST.
Tom
------------------------------
From: "Kostadin Bajalcaliev" <[EMAIL PROTECTED]>
Subject: Quasi Functions, a way to design Maximum Secure Cipher (rep to Scott)
Date: Sun, 13 May 2001 14:40:26 +0200
Don't forget you'll need to define the associativity.
THERE IS NO NEED TO ASSOCIATIVITY AT ALL.
GENERALY YOUR ATTACK CAN WORK, BUT IF YOU HAVE READ THE THEIS X MUL Y IS
DEFINED AS X MUL Y = X+ X * Y + Y, JUST BECAUSE WHAT YOU HAVE DESCRIBED CAN
HAPPEND BY USING MULTIPLICATION. HAVING THIS SMALL CHANGE IN MULTIPLICATION
(BECAUSE 2^32+1 IS NOT A PRIME) DISSABLE THE ATTACK YOU HAVE DESCRIBED. YOUR
ATTACK IS BASED ON ASSUMPTION THAT THERE ARE WILL BE ENOUGHT PLAINTEXTS
HAVING A LOT OF ZEROS, WHICH IS POSSIBLE, USING A SIMPLE MULTIPLICATION WILL
RESULT IN NO CHANGES TO BE DONE IF THE MULTIPLICATION IS CHOUSEN BY R3, AS I
SAID THIS PROBLEM HAVE BEEN NOTICED. THERE IS ONE FURHTER COMPLICATION, HERE
IS THE CODE:
int JV_Encrypt(void *block)
{
UL *BL, O[4], T, P;
UI R,i;
BL=(unsigned long *)block;
for(R=0;R<16;R++)
{
>>>>>>>> BL[0]+=BL[1]+BL[2]+BL[3]; T=BL[0];
P=JV_Key[(UI)(T%16)]; T>>=4; P=ROT32(P,T%16); T>>=4;
O[0]=BL[1];
O[1]=JV_Key[(UI)(T%16)]; T>>=4; O[1]=ROT32(O[1],T%16); T>>=4;
O[2]=BL[2];
O[3]=JV_Key[(UI)(T%16)]; T>>=4; O[3]=ROT32(O[3],T%16); T>>=4;
for(i=0;i<4;i++)
{
switch(T%4)
{
case 0: P+=O[i]; break;
case 1: P^=O[i]; break;
case 2: P=((P*O[i]) + P + O[i])%0xFFFFFFFBL; break;
case 3: P-=O[i]; break;
}
T>>=2;
}
BL[3]^=P;
T=BL[3]; BL[3]=BL[2]; BL[2]=BL[1]; BL[1]=BL[0]; BL[0]=T;
}
return 0;
}
Free hint: no cryptographer with a clue would ever confidently describe
anything he invented as "immune to all possible (existing and
to-be-invent[sic]) attacks", at least, not without an iron-clad mathematical
proof in hand.
THANKS FOR THE HINT. AND THANKS FOR CONFIRMING MY CONSLUSIONS ABOUT
MULTIPLICATION MOD 2^32 AND THE JUSTIFICATION OF USING X MUL Y = X + XY + Y.
THERE IS A LOT OF MATH IN THE THESIS DESCRIBING THE MODEL, AND MAXIMUM
SECURE CIPHER IS A CONCEPT INTRODUCED, THERE IS NO CLAIM THAT THE CIPHER
PRESENTED IS MAXIMUM SECURE, ONLY THING CLAIMED IS THAT PME CAN BE USED IN
DESIGNING THE MAXIMUM SECURE CIPHER.
--
poncho
------------------------------
From: "Kostadin Bajalcaliev" <[EMAIL PROTECTED]>
Subject: Quasi Functions, a way to design Maximum Secure Cipher (rep To MARK)
Date: Sun, 13 May 2001 14:41:14 +0200
> or
> http://kbajalc.tripod.com/algo/theory/pme
No, it's not.
WHAT EXACTLY IS MISSING ?
I pause here to note that you're rotating 32-bit things by amounts
between 0 and 15. You really want 5-bit rotate amounts.
THERE HAVE BEEN NO OTHER CHOICE IF I WANT TO USE ALL THE BITS BUT ONLY ONCE
PER TRANSFORMATION.
> Fox example having T=To=11 01 00 10 0010 1101 0101 1001 1011 1010
> The function F will be:
>
> F[To](A1,A2) = (S[10] <<< 11) * A1 + (S[9] <<< 5) xor A2 - (S[13] <<< 2);
Your cipher has very poor downwards diffusion. In particular, I believe
that a change in the top n <= 8 bits of any or all of the plaintext
words will only affect the top n bits of the ciphertext words. This (a)
is a trivial distinguisher for SQ6 and (b) leads to a fairly simple
key-recovery attack.
I DONT THINK SO, CHANGE IN ANY OR ALL THE 8 MSB IN THE PLAINTEXT WILL RESULT
ONLY THE LSB BE THE SAME FOR ADD XOR & SUB.
> Maximum Secure Cipher (MSC) is an encryption algorithm immune to all
> possible (existing and to-be-invent) attacks.
That's a bold claim. Try proving it. Don't just wave hands: prove it.
MSC IS A CONCEPT, NOTHING EXISTING I CLAIM TO BE MSC. NOBODY PROVE EXISTANCE
OF CONCEPTS.
> The first approach is to design cipher immune to the attack, and the
> second to design cipher incompatible to the attack. For example, there
> is no use of the Differential cryptanalysis if the cipher is not
> Feistel-Network based, AES is a nice example.
No. Completely wrong. Differential and linear-approximation techniques
can be applied to any cipher. It's not even true that Feistel networks
are particularly susceptible to these kinds of attacks. The reason that
Rijndael is resistant to differential cryptanalysis is that it's been
carefully optimized (using the wide-trail system).
IT IS TRUE THAT MOST OF CIPHERS CAN BE ANALIZED USING THE DIFFERENTIAL
CRYTPANALYSIS BUT IT IS SIGNIFICANTLY HARDER TO ANALIZE THOSE NOT USIGN FN.
SQ6 CAN NOT BE ANALIZED AT ALL, THEORETICLY THERE CAN BE SOME DIFFERENTIALS
BUT THE ASSUMTIONS ABOUT THOSE ATTACKS WILL BE TOO BIG.
Your cipher above, indeed, demonstrates differential weakness that is
well beyond anything exhibited by DES.
INTERESTING I WOULD BE HAPPY TO HEAR HOW IT WILL BE DONE.
-- [mdw]
------------------------------
From: Erwann ABALEA <[EMAIL PROTECTED]>
Subject: Re: About DES or AES ?
Date: Sun, 13 May 2001 15:45:41 +0200
On Sun, 13 May 2001, Tom St Denis wrote:
>
> "Cheng-Fen" <[EMAIL PROTECTED]> wrote in message
> news:9dlshj$p9o$[EMAIL PROTECTED]...
> >
> > How can I tell a high school student
> > or freshment that
> > AES or DES is a permutation?
>
> Simple. They both have inverses. All invertable functions are
> permutations.
And substitution.
--
Erwann ABALEA
[EMAIL PROTECTED]
- RSA PGP Key ID: 0x2D0EABD5 -
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list by posting to sci.crypt.
End of Cryptography-Digest Digest
******************************
