Cryptography-Digest Digest #367
Cryptography-Digest Digest #367, Volume #10 Wed, 6 Oct 99 05:13:03 EDT
Contents:
Re: factoring with quadratic sieve (jerome)
Securing Windows 95 Swap/Temp Files (long) ([EMAIL PROTECTED])
Re: radioactive random number generator (jjlarkin)
Re: radioactive random number generator (Boris Kazak)
Re: EAR Relaxed? Really? (Greg)
RSA Cryptography Today FAQ (1/1) ([EMAIL PROTECTED])
Re: Random number generation ("Richard Parker")
From: [EMAIL PROTECTED] (jerome)
Crossposted-To: sci.math
Subject: Re: factoring with quadratic sieve
Reply-To: [EMAIL PROTECTED]
Date: Wed, 06 Oct 1999 02:07:03 GMT
The poster tries to find a library which have it and let him access
to it. If somebody had a online copy, it would have been a waste
of time to visit the local libraries, a time precious because i am
just an amateur. So i still think my question was suitable.
Thanks for your offer but i will use it only if i don't find locally
a local copy.
On Tue, 05 Oct 1999 14:44:37 GMT, Bob Silverman wrote:
Note that I also offerred to *send* a hard copy if only the poster
would send private email with his/her snail mail address. So far, I
have heard nothing further. This tells me that the person involved
really isn't that interested.
--
From: [EMAIL PROTECTED]
Subject: Securing Windows 95 Swap/Temp Files (long)
Date: Wed, 06 Oct 1999 03:17:52 GMT
Hello fellow sci.crypters,
I have been doing a survey of encryption products
for the Windows operating system. Many fine
products are available but none address the
problem of plain text leaking. The most obvious
examples of plain text leaks are the virtual
memory swap file and temporary directories. Many
other leaks exist as well e.g. INI files often
contain sensitive information. As long as plain
text leaks, an attacker may gain information about
secure files or even a key(s) via the swap file.
I am interested in security when the computer is
OFF, BTW. So far as I can tell, if someone can
access your computer while it is on and logged in,
then no products are secure. Hardware or
operating system help would be required for
the on-line scenario.
To have confidence in an encryption product on a
Windows machine:
1. All sensitive files must be strongly encrypted
perhaps via a virtual hard drive
2. All temporary files must be strongly encrypted
perhaps via a VXD
3. All configuration files must be strongly
encrypted perhaps via VXD.
I have designed and partially written a solution
for steps 2 and 3.
Step 1 can be accomplished by placing all
sensitive apps and data on a virtual disk e.g.
BestCrypt NP, ScramDisk, etc. Now if temporary
and configuration files can be encrypted, Windows
should be much more secure.
Here is my design for a VXD/GUI combination to
solve steps 2 and 3 under Windows 95. I would
like interested members of this group to look at
the security of the design. I intend to release
the software into the public domain as freeware.
If I put a huge amount of work into it I may
release a professional shareware version.
The tentative name of the app is Avalanche. The
block cipher is Twofish and the PRNG is Yarrow
both thanks to the brains at Counterpane. I just
happen to like Twofish, any other 128 bit cipher
would work. I am using the VxdWriter toolkit. The
toolkit is quite useful and low priced. I have
borrowed knowledge and code from the FileMon
utility from Sysinternals.
VXD design
The VXD has following requirements:
1. Intercept all I/O between windows and the
files/directories/process in question
2. Strongly encrypted/decrypted I/O in real time
3. Impose a minimum performance penalty on the OS
4. Securely generate and store new keys for new
files
5. Securely handle keys for all ready encrypted
files
6. Robustly watch for errors to avoid data
corruption
7. Avoid reentrancy into Win 95 IOS
I have already written most of this part. It
seems to be working well but needs polishing.
Currently all keys are read in at start up time,
this takes up quite a bit of memory.
Here is how is works:
1. At startup one key for each encrypted file is
read into (non-paged) memory and decrypted using a
master key. The master key is generated from the
users pass phrase.
2. As files are opened, they are check against a
list of directories to encrypt. I want to support
file and process level encryption as well. The
swap file is encrypted.
3. When a file is read/written is key is retrieved
from the internal list.
4. The swap file is encrypted with a one time
session key. Nobody may look at it after
shutdown.
5. The files are encrypted/decrypted as follows:
The block offset is determined by the file offset
div 16 (128 bits)
The byte offset is determined by the file offset
mod 16
Twofish is initialized with the key
The block number is transformed into a 16 byte
string and encrypted. This is an example of
Counter Mode.
The plain text is XOR
Cryptography-Digest Digest #368
Cryptography-Digest Digest #368, Volume #10 Wed, 6 Oct 99 17:13:03 EDT
Contents:
Re: Mcafee Encryption in UK (Tom McCune)
Re: Twofish on FPGAs (Solar Designer)
Re: There could be *some* truth to it ([EMAIL PROTECTED])
Re: Which encryption for jpeg compressed pictures? (Tom Clune)
Re: Securing Windows 95 Swap/Temp Files (long) (Paul Koning)
Re: rc5-128 cracking $20 per letter ("John A Croll")
Re: Which encryption for jpeg compressed pictures? (John Savard)
Re: Ritter's paper ("Trevor Jackson, III")
Re: EAR Relaxed? Really? (wtshaw)
Re: rc5-128 cracking $20 per letter (John Savard)
Help: Mobility of the Private Key within PKI ([EMAIL PROTECTED])
Re: rc5-128 cracking $20 per letter ("John A Croll")
Re: There could be *some* EIAC ([EMAIL PROTECTED])
Re: Securing Windows 95 Swap/Temp Files (long) (Christopher Biow)
Re: rc5-128 cracking $20 per letter ("John A Croll")
Re: Invention Secrecy Order (was Re: EAR Relaxed? Really?)
([EMAIL PROTECTED])
Re: Research paper... ("almis")
Re: EAR Relaxed? Really? (Alan Mackenzie)
Re: rc5-128 cracking $20 per letter (Jim Gillogly)
From: [EMAIL PROTECTED] (Tom McCune)
Subject: Re: Mcafee Encryption in UK
Date: Wed, 06 Oct 1999 10:48:04 GMT
=BEGIN PGP SIGNED MESSAGE=
In article [EMAIL PROTECTED],
[EMAIL PROTECTED] (UBCHI2) wrote:
I walked into a pc store in London and noticed that the Mcafee PGP Suite
program from Network Associates was for sale. I thought that you couldn't
sell
that in the UK. It allows PGP encryption with CAST or IDEA up to 4039 bit
keys. Is the store doing something illegal, or is it a version with a back
door?
It was probably produced by NAI's relatively new international division at
http://www.pgpinternational.com/
=BEGIN PGP SIGNATURE=
Version: 6.0.2 - Tom McCune's PGP Pages: http://www.Tom.McCune.net/PGP.htm
Comment: KeyID: 0x7F553C2D
iQCVAwUBN/so4cMxrQ5/VTwtAQHiOgP+KVA0UNR4IKBfCCKvaJ6HYoLtYIPu6gTe
CvmMfZhbVfktZKZwepGWJLzDL8qr+Qnq9fIyvyfIOS1FcYiNO3HpGaInmL4kmfPN
h4/6f9m9yBqWD1DFrYwfyxRidy49RpzNI/dBCPWn2Y6morH17ChGUVFE2xcCoV47
XiHKiZoxnVc=
=gM/U
=END PGP SIGNATURE=
--
From: Solar Designer [EMAIL PROTECTED]
Subject: Re: Twofish on FPGAs
Date: 6 Oct 1999 10:49:22 GMT
Bruce Schneier [EMAIL PROTECTED] wrote:
Prof. Kris Gaj as implemented Twofish on an FPGA. His report on the
process is at:
http://www.counterpane.com/twofish-fpga.html
An interesting read, thanks.
BTW, the "implementing Blowfish in hardware" link on your site is broken;
perhaps you could also replace it with a local copy for us? :-)
" David Honig has written a paper about implementing Blowfish in
hardware."
http://www.geocities.com/SiliconValley/Campus/9853/BFCHIPDES.DOC
This URL is no longer valid (not to mention that I would prefer not having
to play with the .DOC, but the topic could be worth it in this case).
--
/sd
--
From: [EMAIL PROTECTED]
Subject: Re: There could be *some* truth to it
Date: Wed, 06 Oct 1999 12:26:46 GMT
In theory, anyway, quantum computers would be "infinitely" fast for
certain types of computations (including brute force key searches).
Thus, it wouldn't matter how big your key was.
Can you give a reference to the paper showing how quantum computers will
be able to do brute force key searches "infinitely" fast. This is news
to me.
Sent via Deja.com http://www.deja.com/
Before you buy.
--
From: Tom Clune [EMAIL PROTECTED]
Crossposted-To: comp.security.misc,comp.graphics.algorithms,comp.compression
Subject: Re: Which encryption for jpeg compressed pictures?
Date: Wed, 06 Oct 1999 12:46:00 GMT
In article [EMAIL PROTECTED],
[EMAIL PROTECTED] (Herbert Kleebauer) wrote:
I'm writing a viewer for encrypted multi-jpeg files.
Because I'm not familiar with encryption, I need some
help. I need an encryption which is
1. absolutely secure. If you have the original and the
encrypted file, it must be impossible to proof, if
one is the encrypted version of the other.
2. fast
3. free
In a first version (you can download the c-source and a
WINDOWS binary from ftp://137.193.64.130/pub/jpeg/ )
I'm using IDEA. But IDEA is patented by ASCOM and the
free use is very restricted. Any suggestions for the
encryption algorithm?
The bible on these things for software engineers is _Applied
Cryptography, 2nd Edition_ by Bruce Schneier (John Wiley Sons, 1996).
It discusses all aspects of a wide variety of encryption algorithms. I
would read that if I wanted to decide which approach best met my
requirements. FWIW
--Tom Clune, MediSpectra, Inc.
Sent via Deja.com http://www.deja.com/
Before you buy.
--
From: Paul Koning [EMAIL PROTECTED]
Subject: Re: Securing Windows 95 Swap/Temp Files (long)
Date: Wed, 06 Oct 1999 09:55:49 -0400
[EMAIL PROTECTED] wrote:
Hello
Cryptography-Digest Digest #369
Cryptography-Digest Digest #369, Volume #10 Wed, 6 Oct 99 20:13:03 EDT
Contents:
Re: rc5-128 cracking $20 per letter (Tom St Denis)
Re: rc5-128 cracking $20 per letter (Tom St Denis)
Re: rc5-128 cracking $20 per letter (Tom St Denis)
Re: Exclusive Or (XOR) Knapsacks ([EMAIL PROTECTED])
Re: Which encryption for jpeg compressed pictures? (jerome)
books about elliptic curves (jerome)
Re: DES breaker Technique? (jerome)
Re: classifying algorithms (jerome)
Re: radioactive random number generator ("John E. Kuslich")
Re: Which encryption for jpeg compressed pictures? (Paul Koning)
Re: There could be *some* truth to it (Dan Day)
Re: radioactive random number generator ("John E. Kuslich")
Re: radioactive random number generator ("John E. Kuslich")
Re: Which encryption for jpeg compressed pictures? (fungus)
Re: True Random numbers (fungus)
Block encryption with variable keys (Mok-Kong Shen)
Re: Block encryption with variable keys (John Savard)
Re: Is 128 bits safe in the (far) future? (John Savard)
From: Tom St Denis [EMAIL PROTECTED]
Subject: Re: rc5-128 cracking $20 per letter
Date: Wed, 06 Oct 1999 19:28:58 GMT
In article [EMAIL PROTECTED],
[EMAIL PROTECTED] (John Savard) wrote:
"John A Croll" [EMAIL PROTECTED] wrote, in part:
your message is:
"sHure sHow me it"
in response to Tom St. Denis, who wrote:
Ok decrypt this
1602d701fa1ac1ad
Unfortunately, this message is only eight bytes long, and your
decryption is 16 bytes long.
S... don't tell him that.
Tom
Sent via Deja.com http://www.deja.com/
Before you buy.
--
From: Tom St Denis [EMAIL PROTECTED]
Subject: Re: rc5-128 cracking $20 per letter
Date: Wed, 06 Oct 1999 19:30:28 GMT
Ok if you destroyed RC5 what is the message I sent? You got it wrong in your
other post. Tom
In article 7tg499$igt$[EMAIL PROTECTED],
"John A Croll" [EMAIL PROTECTED] wrote:
rc5 has a wide open back door for the feds and i found it.
i think they should give me the rsa prize money
because i destroyed rc5 as a viable product.
Sent via Deja.com http://www.deja.com/
Before you buy.
--
From: Tom St Denis [EMAIL PROTECTED]
Subject: Re: rc5-128 cracking $20 per letter
Date: Wed, 06 Oct 1999 19:32:25 GMT
In article 7tg16g$8q3$[EMAIL PROTECTED],
"John A Croll" [EMAIL PROTECTED] wrote:
your message is:
"sHure sHow me it"
you owe me 320 bucks!
you may remit payment to:
richard lee king jr.
p.o.box 236
st.bernice,
in. 47875-0236
phone: 765-832-2557
you need to buy better security.
First off you got the message wrong, second the message is only 8 ascii chars
not 16. Third I did not buy RC5, I took the RSAREF code, thru in a main()
and gave you the ciphertext.
If you think I am making this up, just admit defeat and I will give you the
key that will decrypt it.
Tom
Sent via Deja.com http://www.deja.com/
Before you buy.
--
From: [EMAIL PROTECTED]
Subject: Re: Exclusive Or (XOR) Knapsacks
Date: Wed, 06 Oct 1999 19:35:41 GMT
[EMAIL PROTECTED] (Guenther Brunthaler) wrote:
Matt Timmermans" wrote:
Let me just make up an example:
...
3rd bit
1010 = B1
0101 = B2
0011 = B1+B3
0010 = B1+B4 +B2
...
So, for any 4 bit X...
Looks very interesting!
But could you please explain your approach in more detail?
You can find Gaussian elimination in any linear
algebra text.
Also, is it coincidence that in your example there are B1..B4 and also
4 bits in X?
Not a coincidence. The question was:
| Problem:
| Given an n bit number X and a set {B1,B2,...,Bn}
| of n bit numbers;is there a subset whose elements
| collectively XORed give X?
Perhaps you could outine your example for the following (1-bit) setup:
X=1, B1 = 0, B2 = 0, B3 = 0, B4 = 1, B5 = 1, B6 = 1
and the size of the requested subset shall be 3.
This fails to be an example of the stated problem.
[...]
I really would be interested how any equation system could help find
some specific calculated solution, as there may be any number of
solutions!
Again, a linear algebra text will explain. If
any subset of the vectors xors to zero, then that
subset can be xored into any solution to produce
another solution, and all solutions may be
produced this way.
Genetic algorithms? Backtracking? P?=NP?
Nonsense - it's a simple linear algebra problem.
--Bryan
Sent via Deja.com http://www.deja.com/
Before you buy.
--
From: [EMAIL PROTECTED] (jerome)
Crossposted-To: comp.security.misc,comp.graphics.algorithms,comp.compression
Subject: Re: Which encryption for jpeg compressed pictures?
Reply-To: [EMAIL PROTECTED]
Date: Wed, 06 Oct 1999 17:05:38 GMT
On Wed, 06 Oct 1999 07:53:40 -0700, Samuel Paik wrote:
One of the public key systems is about to fall out of
patent (in the US at least).
which one ?
RSA patent will finish in sep 2000, no ?
