Re: The problem with Steganography

2000-01-27 Thread Russell Nelson
Ben Laurie writes: If you want a lot of people to see it, you can't keep it secret. If you can't keep it secret, you may as well just come out with it and publish the bits without stego. What did I miss? It depends on how hostile the regime is. If you want to publish something but

Re: The problem with Steganography

2000-01-27 Thread Arnold G. Reinhold
At 1:34 AM -0500 1/26/2000, Marc Horowitz wrote: Rick Smith [EMAIL PROTECTED] writes: The basic notion of stego is that one replaces 'noise' in a document with the stego'ed information. Thus, a 'good' stego system must use a crypto strategy whose statistical properties mimic the noise

A big safe source of random (colored) bits

2000-01-27 Thread Russell Nelson
Okay, here's something I've been thinking of for a while. Run a political discussion mailing list which mails audio files back and forth. This list, at least in the US, would enjoy the highest Constitutional protection. However, you'd never know if the low bits of the audio stream have been

Re: How old is TEMPEST?

2000-01-27 Thread Alexandre Alvarez
"The Ultimate Spy" book (by Keith Melton, published by Dorling Kindersley) describes "the thing", a russian spying device in the 1950's, it also features a lot of radio equipment and a non-contact (induction) spying device for telephones (based on the Hall phenomenon). regards, Alexandre

Re: The problem with Steganography

2000-01-27 Thread Steve Reid
On Tue, Jan 25, 2000 at 04:51:12PM -0800, Nelson Minar wrote: Of course, this isn't easy to do - "matching statistical properties" isn't a simple closed problem. But I bet you could do fairly well in certain circumstances. For instance, Linux uses a strong random number when starting a TCP

Re: The problem with Steganography

2000-01-27 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Marc Horowitz writes: In short, is steganography the ultimate surveillance tool? Like most surveillance technologies, this is a game of constant incremental improvements. You watch me through a window, I put up curtains. You listen through a hidden

Re: legal status of RC4

2000-01-27 Thread Paul Crowley
Vin McLellan [EMAIL PROTECTED] writes: I suspect that RSA did send out more than a few nastygrams to OEMs or other mass marketeers about "illicit use" of RC4, but -- at least in recent years -- its complaints probably went to commercial enterprises which both (a) sought to resell the

Re: The problem with Steganography

2000-01-27 Thread j
question becomes, without identifying the location of the ciphertext in a prior agreement or on some outside channel, can a person communicate with friends without alerting enemies to the existance of secret communications? In this case you are entering the realm of psychology. There may be a

Re: The problem with Steganography

2000-01-27 Thread Rick Smith
At 12:12 AM 01/27/2000 +, Ben Laurie wrote: I can't quite see the point of forward stego. I'll leave it to Russ to explain his application if he wants to. Why not publish something public key encrypted and publish the private key later? Symmetric cryptography has two advantages in this

Re: prove me wrong, go to jail

2000-01-27 Thread Ed Gerck
Ted Lemon wrote: Amateurs in the crypto world seem to get bitten by this fairly frequently - read the recent transcripts to the New York preliminary injunction on the DeCSS case for supporting evidence. If you're out to prove a point, and you're riding the fine edge of legality and civil

Re: prove me wrong, go to jail

2000-01-27 Thread Ted Lemon
Comments? I think your proposal is not entirely unreasonable, although I wonder if the people who have the most interest in a secure system are not the banks, but the insurance companies and the customers. My impression of banks is that as long as they can quantify the potential loss, they

Truth-In-Advertising proposal, was Re: prove me wrong, go to jail

2000-01-27 Thread Ed Gerck
Ted Lemon wrote: Ed Gerck wrote [reinserted for context]: In fact, if there would be a pre-defined reward for those that find holes in today's increasing electronic and "secure" systems then companies could rely in that reward both as a payment cap and as way to separate reward from