Cryptography-Digest Digest #385, Volume #14 Fri, 18 May 01 16:13:01 EDT
Contents:
Re: Questionable security measures (CIC and Cloakware!) ("Tom St Denis")
Re: Questionable security measures (CIC and Cloakware!) ("Tom St Denis")
Re: OT lethal force; was: ON-topic - UK crime statistics (was Re: ("Trevor L.
Jackson, III")
Re: PRNG question from newbie (Stefan Lucks)
Re: What is a group? [Re: OAP-L3: "The absurd weakness."] (Anthony Stephen Szopa)
Re: Questionable security measures (CIC and Cloakware!) (Jeffrey Williams)
Re: OFF-topic by now - UK crime statistics (was Re: Best, Strongest ("Trevor L.
Jackson, III")
Re: OAP-L3: "The absurd weakness." (Anthony Stephen Szopa)
----------------------------------------------------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Questionable security measures (CIC and Cloakware!)
Date: Fri, 18 May 2001 19:42:36 GMT
"Darren New" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> Tom St Denis wrote:
> > Well I am not a businessmen. I am (trying to be) a scientist.
>
> It's hard to be a scientist working for a business, true. The aims of
> the two are often contradictory.
>
> > I believe in
> > pure facts and hard core empiracle evidence.
>
> Fact: businesses are there to make a profit. Fact: interns badmouthing
> the business hurts profit. :-)
Fact: Money is some imaginary object we invented to replace slugging each
other in the heads in order to steal things.
>
> > Why must the world suck? Just "because it does"?
>
> It doesn't suck. It's just not all about inhuman facts. The human facts
> enter into it also.
>
> Fact: your boss probably got flack if your boss' boss saw your posts.
Fact: My boss is the boss.
> Fact: Your boss values his job more than he values yours. :-)
Fact: My boss didn't provide a real reason why he fired me. Wonder why?
>
> --
> Darren New / Senior MTS & Free Radical / Invisible Worlds Inc.
> San Diego, CA, USA (PST). Cryptokeys on demand.
> This is top-quality raw fish, the Rolls-Rice of Sushi!
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Questionable security measures (CIC and Cloakware!)
Date: Fri, 18 May 2001 19:43:17 GMT
"Darren New" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> Tom St Denis wrote:
> > Well I would rather not be on a team of people that only care about the
> > money and little on the impact they will have.
>
> That's good. Now you're not. Why are you complaining? ;-)
> (Just kidding.)
>
> I'd just like to say that there *are* people who *do* care yet manage to
> make money as well. I was privledged to work at a company where the
> motto was:
>
> Work on anything that satisfies at least two of these:
> 1) It's fun
> 2) It does good
> 3) It makes money
>
> Note that it's the *people* who have the integrity, and not the company
> itself. Follow the people about once you find them. From my limited
> experience, it's fairly easy to tell when you've found such a shop, and
> when it has dried up.
I want your job :-)
Tom
------------------------------
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: OT lethal force; was: ON-topic - UK crime statistics (was Re:
Date: Fri, 18 May 2001 19:44:26 GMT
[EMAIL PROTECTED] wrote:
> "Trevor L. Jackson, III" <[EMAIL PROTECTED]> writes:
> >
> > The technical term is "disparity of force". It justifies a response ot a
> > threat that is at a higher level of nastiness than that of the threat. E.g,
> > where a police officer may use any necessary force, a citizen is restricted
> > to the use of only equal force. (fist/fist, knife/knife, firearms/firearm).
>
> You must be from Connecticut. There (I was told as a boy) you cannot sustain
> a charge of self-defense if you are better armed than your attacker. Of
> course it's quite clearly an asinine concept. If a man is raping your wife
> at knifepoint, you have to put away your gun and run looking for a knife
> with which to defend her--to give the rapist a fair chance. Lovely.
I agree that it is an asinine concept as you've presented it. But if someone is
slaps you it is hard to justify deploying nukes. Note that a knife is an
instrument of lethal force so any other form of lethal force, say a firearm or an
automobile, is justified.
I suspect you've heard a mixture of two separate ideas, one of which is equal
force and the other is the higher standard of behavior expected of those carrying
arms. For instance, a person carrying a firearm is expected to avoid arguments,
"fighting words", push and shoving, wrestling, fist fights, and bar fights. The
well known tendency is for those altercations to escalate. An armed person is
required to walk away, even retreat, from those incidents, even at considerable
cost in dignity, rather than stand his ground. Except in the home or similar
situation, where the castle doctrine still prevails in spite of Massachusetts
attempts to change it, an armed person is required to retreat if possible.
Only an _unavoidable_ threat justifies lethal force. If you are standing in a
parking lot and during the incident someone announces that they will be right back
with a club/knife/gun to beat/cut/shoot your head in/off/though you are required
to avoid the confrontation. If you linger and the assailant returns with a weapon
you cannot shoot him and claim self defense because the confrontation was
avoidable.
>
>
> The doctrine is founded on the stupid assumption that ``if he has a knife
> and you have a semi-auto shotgun, then you can't have felt your life
> threatened.'' Thankfully, not all states have the same asinine doctrine.
There are many stupid statutes. But the law is not what is written, the law is
what is enforced.
Note that the doctrine of knife as a weaker form of lethal force is obsolete. A
member of the Salt Lake City police department teaching at Gunsite Training Center
tested the dynamics of knife against gun almost 20 years ago. He constructed a
drill where one person with a knife runs 21 feet (7 yards is the average incident
distance from the FBI crime statistics) yards to a target and stabs it, and other
person attempts to draw and fire at a target. The median for both actions is
about 1.5 seconds. An elderly knife wielder might take up to two seconds. In
this scenario a tie is a loss.
So a knife wielder across the street is at least as lethal as a pistol wielder at
the same distance. In practice almost everyone can strike the vitals with a knife
in less than 2 seconds, and very few can hit the vitals with a holstered pistol in
2 seconds.
The legal establishment is slowly becoming aware of Dennis Tueller's research.
>
>
> The correct doctrine--morally, as IANAL--is that a threat to life and
> limb should be answerable with any force at the victim's disposal,
> up to and including a howitzer or shoulder-fired missile. The victim
> didn't start the fight.
Yes. Any form of lethal threat justifies a lethal response.
>
>
> >> You should not draw a gun unless you have to use it.
>
> Scott, you're confused. This isn't the code of the Samurai here. What
> you meant to say was, ``You should never draw a gun unless you are
> fully prepared to use it, if necessary.''
>
> But note that even this principle has exceptions. If you're standing
> there with an empty pistol, it might not hurt to point the thing and
> say ``freeze''. If you do it with conviction, you have a better than
> 90% chance of carrying the bluff. (But beware; the average person can't
> carry a bluff.)
Nit: "freeze" is a movie command. In practice both the target and witnesses will
hear and testify that you said "please". I'd suggest "Police! Stop! Don't move!
Drop the weapon!". The first command is critical. One is _calling_for_ the
police, not impersonating them -- but a failed interpretation is effective too.
The last command is particularly important if no weapon is visible because it puts
the target and witnesses on notice that weapons may be present.
>
> >> Funny thing back then few accidents. My own theoery is when
> >> kids are not taught how to use them is when they get hurt.
> >
> > Absolutely true...The parent's who had exposed their kids to children's
> > handgun training were astounded at how effective it was.
>
> Ditto. I can't comprehend people who believe that ignorance offers
> protection.
------------------------------
From: Stefan Lucks <[EMAIL PROTECTED]>
Subject: Re: PRNG question from newbie
Date: Fri, 18 May 2001 21:47:50 +0200
I wrote:
> > That is exactly the point why pseudorandom oracles don't exist:
> > The basic idea in the Canetti, Goldreich and Halievi paper is to set
> > XXX := "some description of PRO (e.g. a program to compute PRO)" and
> > to let something strange happen if PRO(XXX) is evaluated. A true
> > (theoretical) random oracle does not have such a description, but
> > every pseudorandom oracle has ...
On Fri, 18 May 2001, Roger Schlafly wrote:
> Huhh? There is no proof that "pseudorandom oracles" do not exist.
> Maybe the precise design goals of SHA-1 are unknown, but some
> people use SHA-1 and a PRO.
>
> What the above paper proves is that a PRO will not have all the
> advantages of a true RO. And a true RO does not exist.
>
> It is analogous to saying that a pseudorandom number generator (PRNG)
> will not have all the advantages of a true RNG.
Yes, that is true.
The usual definition of a RRNG is that, given a short random input (the
key), you can generate an output string as long as you need (in the crude
language of complexity theory, a polynomially long string), which is
infeasible to distinguish from a truly random string.
It may be more convenient for the appication to use either a true or a
pseudo RNG, but for the attacker, it does not matter much. If the attacker
can break a scheme which is using a PRNG (and a short randomly chosen
secret key), but not break the same scheme when the PRNG has been replaced
by a true RNG, than the "PRNG" has not been a PRNG at all. When it comes
to security, a PRNG *has* *all* *the* *advantages* of a true RNG.
Are you using a different definition for a PRNG?
The paper I mentioned above indicates that something similar cannot exist
for Random Oracles.
You may distrust the cryptographic strength of any PRNG you actually are
using, but that is, because you do not know whether your generator
acutally is a PRNG or not. (In fact, everyone including me assumes PRNGs
to exist, but that is still an unproven assumption.)
--
Stefan Lucks Th. Informatik, Univ. Mannheim, 68131 Mannheim, Germany
e-mail: [EMAIL PROTECTED]
home: http://th.informatik.uni-mannheim.de/people/lucks/
====== I love the smell of Cryptanalysis in the morning! ======
------------------------------
From: Anthony Stephen Szopa <[EMAIL PROTECTED]>
Crossposted-To: alt.hacker,talk.politics.crypto
Subject: Re: What is a group? [Re: OAP-L3: "The absurd weakness."]
Date: Fri, 18 May 2001 12:51:20 -0700
Alan Mackenzie wrote:
>
> Anthony Stephen Szopa <[EMAIL PROTECTED]> wrote on Tue, 15 May 2001
> 12:59:47 -0700:
> > James Felling wrote:
>
> [ .... ]
>
> > Just do this one point. Or choose perhaps a simpler one like,
> > "Scramble is a group" and tell us what you mean and how this
> > somehow supports your claims.
>
> A group is a mathematical entity consisting of a set of objects (let's
> call them A, B, C, ...) and an binary operation (let's call it *) on
> these objects such that:
>
> (1) For all A, B in the set, A * B is also in the set;
> (2) For all A, B, C in the set, A * (B * C) = (A * B) * C;
> (3) There is an element I (called the "identity"), in the set, such
> that, for all A in the set, I * A = A * I = A;
> (4) For each A in the set, there is an element A' (called the "inverse"),
> such that A * A' = A' * A = I.
>
> Examples of groups:
> (1) The whole numbers with the operation of addition. The identity is
> zero and the inverse of, say, 5, is -5.
> (2) Mixups of the Rubik cube (or, rather, sequences of moves which result
> in these mixups), the operation being concatenating the mixups.
> (3) Permutations on finite sets (where "permutation" is to be though of
> more as "the operation of rearrangement" rather than "an
> arrangement"), with the operation of composition. For example, if A
> = (123)(45), and B = (12)(35), the A * B = (2543) and B * A = (1345).
>
> It is the third example which here is pertinent. If I understand
> correctly, the notion of a group arose originally from abstracting the
> essence of permutations. There is an extensive theory about groups (this
> is an understatement, by the way) and it is fair to say that having a
> grasp of this theory is a prerequisite to making judgements upon the
> security of any cypher based upon permutations.
>
> By "Scramble is a group", I think James meant that there is a group whose
> members are "scrambling with a particular key" and whose operation is
> composing two scrambles. In otherwords, no matter how many times you
> scramble, S(A) * S(B) * .... * S(K), there is a key, Z, such that this
> composite operation is equivalent to S(Z), i.e. the multiple scramble is
> no better than a single scramble.
>
> It's well worth while reading up about groups. A book I found very
> helpful when I was at university was "A First Course In Abstract Algebra"
> by John B. Fraleigh (published by Addison-Wesley 1967, ISBN unknown,
> "Library of Congress Catalog Card No." (whatever that is) 67-17258). I
> don't know if this book's still available.
>
> Hope this helps.
>
> > Thank you.
>
> --
> Alan Mackenzie (Munich, Germany)
> Email: [EMAIL PROTECTED]; to decode, wherever there is a repeated letter
> (like "aa"), remove one of them (leaving, say, "a").
Please read this very recent post:
Subject: Re: OAP-L3: "The absurd weakness."
Date: Thu, 17 May 2001 14:26:03 -0700
I address this point specifically.
------------------------------
From: Jeffrey Williams <[EMAIL PROTECTED]>
Subject: Re: Questionable security measures (CIC and Cloakware!)
Date: Fri, 18 May 2001 15:00:00 -0500
Tom, don't stop caring. Do, however, try to gain a deeper understanding of
the world in which you live. Businesses exist to make money for their
owners. Business decisions (such as not making code openly available for
public scrutiny) do not have to make sense to all of the people affected by
those decisions. It's entirely possible that the decision was cogently made
by a person who felt that it was the best option for the company's interest.
By posting your opinion on the net AND identifying yourself as an employee,
you were openly challenging the decision. That probably wasn't your intent,
but that is likely how it was perceived by management. Actually, I'd be
interested in knowing what exactly you hoped to accomplish with your original
posting. If you were hoping to change management's decision, then you were
indeed openly challenging the decision. Not the right solution unless their
position was legally or morally indefensible. If you were simply venting
frustration, you should try what I do - write the post but don't post it.
Works almost as well and is far less likely to get me into hot water.
Don't stop caring. But do remember to engage brain before engaging mouth. No
one was talking about Cloakware's new product. Why bring it up? If someone
else brought it up, you could have, without mentioning that you were an
employee, said that you'd be happier if their code was available to public
scrutiny. That gets the same message across without being incendiary.
You cannot right every last little wrong that you encounter in life. You have
to pick your moments otherwise you'll burn out far too young.
Jeff
Tom St Denis wrote:
> "Douglas A. Gwyn" <[EMAIL PROTECTED]> wrote in message
> news:[EMAIL PROTECTED]...
> > Tom St Denis wrote:
> > > Then companies like Cloakware should not ...
> >
> > Tom, instead of justifying your position you should
> > try to understand the advice you're getting from more
> > experience people and contemplate it for a while.
>
> Well I think I will just stop caring. That's the impression I am getting.
> So I will take the money, not care about the result of my actions and hope
> for the best (if I get paid overtime... hoping on my own time is a nono).
>
> > *Every* technical organization I have ever seen,
> > and that is a *lot*, has had managerial problems,
> > often making clearly stupid decisions. Unless there
> > is an ethical imperative involved, which does happen
> > but more rarely than you think, the best response is
> > to work within the existing organization to improve
> > it. Fighting the system won't work.
>
> I didn't fight the system I just posted a comment. If that's a fight wow.
>
> >
> > "I fought the Law, and the Law won"
> > - What song was that?
>
> I've heard of it but I can't remember the name
------------------------------
From: "Trevor L. Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: OFF-topic by now - UK crime statistics (was Re: Best, Strongest
Date: Fri, 18 May 2001 19:59:15 GMT
These attributions are mangled.
Eric Lee Green wrote:
> On Fri, 18 May 2001 00:54:16 GMT, Trevor L. Jackson, III <[EMAIL PROTECTED]>
> wrote:
> >> "Trevor L. Jackson, III" wrote:
> >> > And in the U.S. B&E, while a violent crime, does not rise to the level
> >> > of a threat of death or great bodily harm. The only actions that
> >> > justify a potentially lethal response are rape, arson, a lethal threat
> >> > and their respective attempts.
> >>
> >> That's not quite right, and the details are jurisdiction-dependent.
> >
> >Hardly.
>
> See the paper that I discuss below, regarding Louisiana law.
>
> >> In most US jurisdictions, one may lawfully use deadly force to stop
> >> what a reasonable person would perceive to be an immediate threat
> >> of death or grave bodily harm to self or others to whom one is
> >> commonly considered to owe protection (family, guests).
> >
> >In fact, that protection extends to any innocent. And rape and arson are
> >considered exactly such a threat.
>
> >
> >> In some
> >> US jurisdictions uninvited intruders (trespassers) in one's home
> >> are assumed de facto to present sufficient threat to permit use of
> >> deadly force.
> >
> >No. The criteria are ability, opportunity, and jeopardy, and all three must
> >be present in order to justify the use of lethal force. There is no US
> >jurisdiction in which mere presence satisfies those criteria.
>
> Louisiana has the "shoot the burglar" law. Basically, if he entered
> your house via B&E while you were present, Louisiana law assumes that
> he is armed and a clear and present danger to your life. (Note that if
> he entered the house the normal way, by knocking on the door and being
> let in, the criteria that you mention applies).
I suspect you are leaping over a step that I am not. I believe the criteria
apply even in the case of LA law, which has the effect of providing some of the
standards for evaluating whether the criteria have been satisfied. This the LA
law directs an interpretation of certain acts.
Note that judging felonious actions is hard. Judge Brandeis said that "detached
reflection is not called for in the presence of an upraised knife". So a full
analysis is not required. But the typical definition of a felony is one that is
punishable by over a year in prison. So to apply this standard one would have to
be able to categorize the actions as to the particular crime and know the penalty
for each. It is far easier to apply the defense-of-the-innocent standard because
its justification only requires an articulation of the threat. I'd have a hard
time justifying killing a burglar who stole some property (car, jewelry, etc)
over $1000.00 (grand theft == felony?). The hassle of justifying a homicide
simply isn't worth it even in the most generous interpretation of justification.
------------------------------
From: Anthony Stephen Szopa <[EMAIL PROTECTED]>
Crossposted-To: alt.hacker,talk.politics.crypto
Subject: Re: OAP-L3: "The absurd weakness."
Date: Fri, 18 May 2001 12:58:51 -0700
Darren New wrote:
>
> Anthony Stephen Szopa wrote:
> > Just do this one point. Or choose perhaps a simpler one like,
> > "Scramble is a group" and tell us what you mean and how this
> > somehow supports your claims.
>
> Heck, i'm neither a mathematician nor a cryptographer, but I remember
> what a group is from high-school algebra. Reading sci.crypt has taught
> me why it's helpful if your encryption operations aren't groups.
>
> If you don't know what a group is, maybe you should look it up, rather
> than pretending the flaw isn't clearly expressed.
>
> --
> Darren New / Senior MTS & Free Radical / Invisible Worlds Inc.
> San Diego, CA, USA (PST). Cryptokeys on demand.
> This is top-quality raw fish, the Rolls-Rice of Sushi!
Now I know why war exists: it is to rid the planet of ignorance
that may become a threat to survival.
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list by posting to sci.crypt.
End of Cryptography-Digest Digest
******************************
