Cryptography-Digest Digest #636, Volume #14 Sun, 17 Jun 01 18:13:01 EDT
Contents:
Re: 4 more inducted into NSA Hall of Honor (SCOTT19U.ZIP_GUY)
Re: 3 trip encryption Exchange (John Savard)
Re: SRP, PAK-R, Augmented EKE, and Kaliski-Ford Described on Web Site (John Savard)
Re: SHA2 PRNG. ("Cristiano")
Compact CAST style sboxes? ("Tom St Denis")
Re: SHA2 PRNG. ("Tom St Denis")
Re: Bizzare Cryptanalysis ([EMAIL PROTECTED])
Re: Bizzare Cryptanalysis ("Tom St Denis")
Re: Bizzare Cryptanalysis ("Simon Johnson")
Re: Notion of perfect secrecy ("Simon Johnson")
Re: Bizzare Cryptanalysis ([EMAIL PROTECTED])
Re: Notion of perfect secrecy ([EMAIL PROTECTED])
Re: Good book to read (Fritz Schneider)
Re: Good book to read ("Tom St Denis")
Re: Is ECB truly more secure than CBC? (David Wagner)
Re: Good book to read (Joe Peschel)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: 4 more inducted into NSA Hall of Honor
Date: 17 Jun 2001 18:04:37 GMT
[EMAIL PROTECTED] (Douglas A. Gwyn) wrote in <[EMAIL PROTECTED]>:
>The Hall of Honor occupies one wall of the National Cryptologic Museum.
>There was an induction ceremony Thursday for 4 more awardees (3 of whom
>are still alive and attended the ceremony, the 4th being represented by
>family). Read about the Hall at http://www.nsa.gov/honor/index.html
>
I checked it out. Some looked familar but then again its usually
high profile managers that pat each other on the back. Don't forget
I worked for Sam for 26 years. I remember some of our managers getting
major prises we use to head out to J'D's have a few beers and laugh
about it. I think the truth of matter is most managers have a big
load of BS and in fact know very little about the field they manage.
At least modern managers. It would be far more interesting to
know about the real people behind the advances. I'm sure they must
have some beer drinking women chasing guys that do the real work.
Or at least they must have had some when real work was being
done.
David A. Scott
--
SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE "OLD VERSIOM"
http://www.jim.com/jamesd/Kong/scott19u.zip
My website http://members.nbci.com/ecil/index.htm
My crypto code http://radiusnet.net/crypto/archive/scott/
MY Compression Page http://members.nbci.com/ecil/compress.htm
**TO EMAIL ME drop the roman "five" **
Disclaimer:I am in no way responsible for any of the statements
made in the above text. For all I know I might be drugged.
As a famous person once said "any cryptograhic
system is only as strong as its weakest link"
------------------------------
From: [EMAIL PROTECTED] (John Savard)
Subject: Re: 3 trip encryption Exchange
Date: Sun, 17 Jun 2001 18:21:37 GMT
On Mon, 11 Jun 2001 22:17:39 GMT, "Yaron Oren-Pines"
<[EMAIL PROTECTED]> wrote, in part:
>Thanks for the reply. Is this an encryption protocol that cannot be
>cracked? If it was cracked, by whom and when
Massey-Omura, the specific case of the Shamir three-pass protocol
noted, is secure basically for the same reason RSA and/or
Diffie-Hellman are secure.
The only problem with the three-pass protocol is that it doesn't allow
you to achieve public-key-like results with any algorithms that are
more like conventional encryption algorithms than public-key
algorithms, as far as is currently known; this is what some people
hope for, when hearing about the protocol.
John Savard
http://home.ecn.ab.ca/~jsavard/frhome.htm
------------------------------
From: [EMAIL PROTECTED] (John Savard)
Subject: Re: SRP, PAK-R, Augmented EKE, and Kaliski-Ford Described on Web Site
Date: Sun, 17 Jun 2001 18:27:13 GMT
On Sat, 16 Jun 2001 19:06:01 GMT, [EMAIL PROTECTED]
(John Savard) wrote, in part:
>I also included my own wretchedly elaborate protocol, previously
>described here - with one additional correction, of course.
The 'additional correction' was replacing UVERIFY by H(UVERIFY) in the
password table on the computational host. This didn't add any
security, since an attacker could obtain UVERIFY by impersonating the
host.
So I removed that correction again, but thought about how I could
achieve the result I wanted - to bring UVERIFY more centrally into the
protocol, because it was constructed to depend on a lot of things very
intimately, and thus provide good security. As it was, the protocol
was secure, but because the host computer got its random key value, HR
back, and UVERIFY could really be dispensed with.
In explaining the other protocols, though, I noted that Augmented EKE
showed a useful technique for the kind of proof I wanted. So I
modified UVERIFY so that it depended on a quantity even the security
server didn't have, and used it as a Diffie-Hellman private key. The
host computer then only needs to store the corresponding public key in
its password file, and then my protocol makes a bit more sense.
John Savard
http://home.ecn.ab.ca/~jsavard/frhome.htm
------------------------------
From: "Cristiano" <[EMAIL PROTECTED]>
Subject: Re: SHA2 PRNG.
Date: Sun, 17 Jun 2001 21:40:30 +0200
"Tom St Denis" <[EMAIL PROTECTED]> ha scritto:
>
> "Cristiano" <[EMAIL PROTECTED]> wrote in message
> news:9gimtg$d4d$[EMAIL PROTECTED]...
> > I need a cryptographically secure prng.
> > To such purpose I fill a 256 bits vector with 8 pseudorandom 32 bits
> numbers
> > and then:
> > 1) I hash the vector and I store the result in the same vector;
> > 2) I get the 8 numbers;
> > 3) go to step 1.
>
> It's weak against a known output attack. It's forward insecure.
What does it mean in practice?
Now I changed the generator in this way:
1) I fill a 256 bits vector with 8 pseudorandom 32 bits numbers;
2) I hash the vector and I store the result in the same vector;
3) I get the 8 numbers;
4) go to step 1.
It pass all tests. Is there some weakness now? Is there a better way?
Thanks
Cristiano
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Compact CAST style sboxes?
Date: Sun, 17 Jun 2001 19:49:43 GMT
I read a while back [and since have lost the copy of the paper] about the
tricks they were trying todo to make CAST style sboxes. One of them IIRC
was to take four 8x8 sboxes and concatenate the output to make a 8x32. The
NL of the 8x32 would be at *most* that of the worse 8x8 but linear
combinations of any of the 32 bits are not guaranteed to be nonlinear.
Which is why four 8x32s can be used to take different 8-bit subsets of the
32-bit input. By rotating the 8x8 usage you get
S0 = T0 || T1 || T2 || T3
S1 = T1 || T2 || T3 || T0
...
Where T is the 8x8 and S is the 8x32 and || is concatenation.
I was thinking do all four 8x8's have to be unique? Obviously so. But do
they have to be very different? I.e do the E2 trick of rotate input vector,
roate output vector, rotate both. This way from one 256-byte table you get
four sboxes. Since rotation is linear it won't change the DP or LP biases
either [but will skew them about].
In a homebrew test I made four 8x8 random sboxes with a DPmax of 16/256 and
a LPmax of 32/256 (i.e NL of 96). The resulting 8x32 had a DPmax of 1/128
and I haven't tested the LPmax [according to CAST theorems it should be at
least 64 with a 99.5% probability].
The benefits of this over a bijective round function? Very high diffusion.
If the 8 bit input is active all four outputs are active with a virtual
certainty.
Comments?
--
Tom St Denis
---
http://tomstdenis.home.dhs.org
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: SHA2 PRNG.
Date: Sun, 17 Jun 2001 19:57:08 GMT
"Cristiano" <[EMAIL PROTECTED]> wrote in message
news:9gj15m$fan$[EMAIL PROTECTED]...
> "Tom St Denis" <[EMAIL PROTECTED]> ha scritto:
> >
> > "Cristiano" <[EMAIL PROTECTED]> wrote in message
> > news:9gimtg$d4d$[EMAIL PROTECTED]...
> > > I need a cryptographically secure prng.
> > > To such purpose I fill a 256 bits vector with 8 pseudorandom 32 bits
> > numbers
> > > and then:
> > > 1) I hash the vector and I store the result in the same vector;
> > > 2) I get the 8 numbers;
> > > 3) go to step 1.
> >
> > It's weak against a known output attack. It's forward insecure.
>
> What does it mean in practice?
Say you use this PRNG to make an IV then to make a symmetric key for a
cipher. [i.e some PK hybrid like PGP]. If I capture your IV I will get
your symmetric key.
To me this is a big flaw!
> Now I changed the generator in this way:
> 1) I fill a 256 bits vector with 8 pseudorandom 32 bits numbers;
Careful here. You should typically bring in more bits then you put out.
This is because you want to make sure the amount of entropy comming in is
sufficient. Let's say you bring in 256 bits from say the mouse co-ordinates
[the lsbs]. But there is a huge skew of say p=0.95 for 1 in the lsb, this
means your 256 bits has only -256 * log2(0.95) = 19 bits of real entropy.
You would need 3460 bits to get your 256 bits of entropy.
> 2) I hash the vector and I store the result in the same vector;
I don't get this part. Use some pseudocode like
H[i+1] = HASH(H[i])
> 3) I get the 8 numbers;
> 4) go to step 1.
>
> It pass all tests. Is there some weakness now? Is there a better way?
Yes it may appear random but keep in mind so do LFSRs.
How is your "modification" any better?
Tom
------------------------------
Subject: Re: Bizzare Cryptanalysis
From: [EMAIL PROTECTED]
Date: 17 Jun 2001 16:14:07 -0400
"Tom St Denis" <[EMAIL PROTECTED]> writes:
>>
>> However the algebraic definition of differentiating could be
>> given without regard for limits. Example: The derivative
>> of x^n can be * defined* to be n*x^(n-1) with no thought
>> to defining limits.
>
> Yes but the proof comes from first principles. Which are based on
> limits.
Proof of what? If you define the ``derivative'' of a polynomial by
formula, there is no need for limits. Indeed, you can verify yourself
that the chain rule, product rule and the fact that differentiation
commutes with linear operations all follow entirely from the formulaic
definition, without recourse to limits.
Herstein defines derivatives algebraically in order to use them to
talk about repeated roots of equations, without ever having recourse
to calculus.
This is common, BTW. To ``apply calculus facts to algebra'', one first
redefines the calculus notion algebraically, and then proves the
needed properties algebraically. It's the mathematical equivalent of
saying, ``Look: nothing up my sleeve.''
Len.
--
It's always difficult to imagine the effects of a free market when you've
never tried one.
-- Dan Bernstein
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Bizzare Cryptanalysis
Date: Sun, 17 Jun 2001 20:16:27 GMT
<[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> "Tom St Denis" <[EMAIL PROTECTED]> writes:
> >>
> >> However the algebraic definition of differentiating could be
> >> given without regard for limits. Example: The derivative
> >> of x^n can be * defined* to be n*x^(n-1) with no thought
> >> to defining limits.
> >
> > Yes but the proof comes from first principles. Which are based on
> > limits.
>
> Proof of what? If you define the ``derivative'' of a polynomial by
> formula, there is no need for limits. Indeed, you can verify yourself
> that the chain rule, product rule and the fact that differentiation
> commutes with linear operations all follow entirely from the formulaic
> definition, without recourse to limits.
IIRC we were tought that derivatives like d(x^2)/dx = 2x come from the limit
definitions. i.e lim(a=>0) of (F(x) - F(x - a))/a
Tom
------------------------------
From: "Simon Johnson" <[EMAIL PROTECTED]>
Subject: Re: Bizzare Cryptanalysis
Date: Sun, 17 Jun 2001 21:22:02 +0100
"wtshaw" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> In article <9gi4e0$1tj$[EMAIL PROTECTED]>, "Simon Johnson"
> <[EMAIL PROTECTED]> wrote:
>
> > Lets assume for a second that we can define a process by which we can
> > differentiate an algorithm. Now, since all algorithms we use are
> > deterministic and have a period of some description this would seem to
imply
> > that there would also be a period to the differentiation series. Thus,
we
> > can define a Maclaurin expansion for the algorithm..
> >
> > I'm pretty sure extraction of a key could be performed from this
expansion
> > and would be a nice way to attack algebraic ciphers.
> >
> > Simon.
> >
> The problem with bad and/or false assumptions are that they tend to force
> people to thing that only well worn ruts are worth traveling in. You
> could have just as well said, "Let's assume that all algorithms are
> designed to be readily broken and that none would contemplate doing
> otherwise."
>
> Frankly, avoiding the facilitation of nice ways to solve ciphers is rather
> the domain of good crypto design and your suggestion points out the
> prevalence of designs that ignore the basics.
Yah, i'd agree with this.. In a well constructed cipher such an attack would
be impossible... i'm pretty certain this attack has been thought up before
to... its just it requires such a specialist case that its completely
useless..
Simon.
------------------------------
From: "Simon Johnson" <[EMAIL PROTECTED]>
Subject: Re: Notion of perfect secrecy
Date: Sun, 17 Jun 2001 21:34:29 +0100
"Douglas A. Gwyn" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> Tom St Denis wrote:
> > Ok this has gone on too long.
>
> Usually when one hears that, the speaker thinks that he can make a
> definitive statement that will show everybody else the error of
> their ways. That's very arrogant, and foolish when you're wrong.
>
> > Typically what you guys are missing is that the length of the message is
not
> > the secret. It's the contents of the message.
>
> Part of the information content of a (plaintext) message is
> inherent in its length, assuming that a priori you have no
> information that constrains the expected length.
Its a small amount though.. and the amount of information given gets smaller
with when the size increases, since there are more possible plain-texts. By
the time reach a megabyte or so the amount of information given would be
very small indeed.
Simon.
------------------------------
Subject: Re: Bizzare Cryptanalysis
From: [EMAIL PROTECTED]
Date: 17 Jun 2001 16:45:20 -0400
"Tom St Denis" <[EMAIL PROTECTED]> writes:
>
> IIRC we were tought that derivatives like d(x^2)/dx = 2x come from the
> limit definitions. i.e lim(a=>0) of (F(x) - F(x - a))/a
That's true in Analysis. But it's perfectly possible to define derivatives
symbolically (for polynomials, say), and to derive a perfectly consistent
theory without any recourse to limits. And it is done.
Len.
--
As I said before, it's funny how you keep talking about standards
compliance when you can't even get the basics right.
-- Dan Bernstein
------------------------------
Subject: Re: Notion of perfect secrecy
From: [EMAIL PROTECTED]
Date: 17 Jun 2001 16:46:50 -0400
"Simon Johnson" <[EMAIL PROTECTED]> writes:
>>
>> Part of the information content of a (plaintext) message is
>> inherent in its length...
>
> Its a small amount though...By the time reach a megabyte or so the
> amount of information given would be very small indeed.
Indeed, by time you reach 5KB, the message could be almost any non-binary
post ever posted to usenet.
Len.
--
How could it possibly be ``important'' to generate a format that is,
as a practical matter, understood by neither man nor machine?
-- Dan Bernstein
------------------------------
From: Fritz Schneider <[EMAIL PROTECTED]>
Subject: Re: Good book to read
Date: Sun, 17 Jun 2001 14:10:20 -0700
On Sun, 17 Jun 2001, Tom St Denis wrote:
> It covers alot of Shannons work as well as Hammings work. For the most
> part it is not too hard to follow, some of it is above my head but
> that's ok.
Tom, if you're interested in the subject might I suggest "The
Adventures of Secret Agent 00111" by Solomon Golomb as well. It was
suggested to me a few years back on sci.math and was well worth the read.
Of particular merit are the excellent motivating analogies employed in the
first few chapters.
-- fritz
------------------------------
From: "Tom St Denis" <[EMAIL PROTECTED]>
Subject: Re: Good book to read
Date: Sun, 17 Jun 2001 21:19:48 GMT
"Fritz Schneider" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> On Sun, 17 Jun 2001, Tom St Denis wrote:
>
> > It covers alot of Shannons work as well as Hammings work. For the most
> > part it is not too hard to follow, some of it is above my head but
> > that's ok.
>
> Tom, if you're interested in the subject might I suggest "The
> Adventures of Secret Agent 00111" by Solomon Golomb as well. It was
> suggested to me a few years back on sci.math and was well worth the read.
> Of particular merit are the excellent motivating analogies employed in the
> first few chapters.
I will look that up tommorow at school Actually I will just look up
Golomb...
Thanks.
Tom
------------------------------
From: [EMAIL PROTECTED] (David Wagner)
Subject: Re: Is ECB truly more secure than CBC?
Date: Sun, 17 Jun 2001 22:01:28 +0000 (UTC)
Tim Tyler wrote:
>* Protocol can't cope with it - e.g.:
> Multiple recipients, with new keys from a pad at midnight every night.
I don't understand.
>* Recipient or sender is an embedded device - with no PRF handy.
If you can't handle a PRF, you can't handle encryption.
------------------------------
From: [EMAIL PROTECTED] (Joe Peschel)
Date: 17 Jun 2001 22:08:04 GMT
Subject: Re: Good book to read
"Tom St Denis" [EMAIL PROTECTED] writes:
>"Fritz Schneider" <[EMAIL PROTECTED]> wrote in message
>news:[EMAIL PROTECTED]...
>> On Sun, 17 Jun 2001, Tom St Denis wrote:
>>
>> > It covers alot of Shannons work as well as Hammings work. For the most
>> > part it is not too hard to follow, some of it is above my head but
>> > that's ok.
>>
>> Tom, if you're interested in the subject might I suggest "The
>> Adventures of Secret Agent 00111" by Solomon Golomb as well. It was
>> suggested to me a few years back on sci.math and was well worth the read.
>> Of particular merit are the excellent motivating analogies employed in the
>> first few chapters.
>
>I will look that up tommorow at school Actually I will just look up
>Golomb...
>
The partial title might sound a little corny, Tom, but it's a real book.
The full title is "Basic Concepts in Information Theory and Coding:
The Adventures of Secret Agent 00111 (Applications of Communications Theory.)"
It's on Amazon for $91.50, and is described, in part, as:
"A text for a one-semester introductory course limited in scope to discrete
information theory and a general discussion of coding theory without detailed
treatment of algorithms for
encoding and decoding for various specific code classes."
Joe
__________________________________________
Joe Peschel
D.O.E. SysWorks
http://members.aol.com/jpeschel/index.htm
__________________________________________
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list by posting to sci.crypt.
End of Cryptography-Digest Digest
******************************
