Cryptography-Digest Digest #980, Volume #9        Tue, 3 Aug 99 16:13:03 EDT

Contents:
  Re: Academic vs Industrial (Paul Koning)
  Re: OTP export controlled? (Paul Koning)
  Re: Americans abroad/Encryption rules? (Paul Koning)
  Is the output of 3DES really pseudorandom??? (Michelle Davis)
  Re: CFB mode with same initialization vector (Peter Pearson)
  Re: Virtual Matrix Encryption ([EMAIL PROTECTED])
  Re: Help please (WWI/WWII ciphers) (Richard Herring)
  Re: the defintion of Entropy (Patrick Juola)
  Re: With all the talk about random... (Andras Erdei)
  Re: Sufficiently Random numbers (Medical Electronics Lab)
  Re: Sufficiently Random numbers ([EMAIL PROTECTED])
  Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big is a Byte?) 
(Greg Comeau)
  Re: Is the output of 3DES really pseudorandom??? ([EMAIL PROTECTED])
  Re: Question about Information Theory (John Savard)
  Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big  (Ross Smith)
  Re: NORTON Diskreet Decrypt Help me (JPeschel)
  Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big  is  a Byte?) 
(Guenther Brunthaler)
  Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big  is  a Byte?) 
(Greg Comeau)
  Postgraduate Research Scholarships ("Kai O'Yang")
  Re: [Q] Why is pub key cert. secure & free from spoofing? (Greg)
  Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big  is  a Byte?) 
(Guenther Brunthaler)
  Re: [Q] Why is pub key cert. secure & free from spoofing? (Greg)

----------------------------------------------------------------------------

From: Paul Koning <[EMAIL PROTECTED]>
Subject: Re: Academic vs Industrial
Date: Thu, 29 Jul 1999 15:12:39 -0400

"Markku J. Saarelainen" wrote:
> 
> There seems to be building up a consensus that many academic algorithms
> and standardization results are quite ineffective for any serious data
> protection purposes due to covert influences by certain intelligence and
> code braking agencies. Surely, these standards should not be used for
> any industrial data security applications.

Where did you get that idea?

My impression is exactly the opposite.  Academic work has been
creating problems for spooky control of crypto since the early
days of RSA.  Later work (IDEA, CAST, Blowfish, all the AES
proposals) continue this trend.

Or are you trying to say that none of these are any good because
they are all controlled by the NSA?  Are you a David Scott clone?

        paul

------------------------------

From: Paul Koning <[EMAIL PROTECTED]>
Crossposted-To: talk.politics.crypto
Subject: Re: OTP export controlled?
Date: Fri, 30 Jul 1999 16:29:05 -0400

"W.G. Unruh" wrote:
> ...
> >It is ludicrous to think that export regulations can really keep
> >foreigners from implementing decent encryption.
> 
> Not their purpose.

It IS the stated purpose.  It has to be for it not to be laughed
out of the room.

> Their purpose is to pervent US residents from providing
> foreigners with decent encryption. 

I don't think so.  If you mean the unstated purpose (or not so
clearly stated purpose), that is to keep strong crypto out of
the hands of US residents.  Look at Freeh's testimony, it's
clear enough if you read it carefully.

        paul

------------------------------

From: Paul Koning <[EMAIL PROTECTED]>
Subject: Re: Americans abroad/Encryption rules?
Date: Mon, 02 Aug 1999 17:57:22 -0400

Dmitri Alperovitch wrote:
> 
> >I think the phrase "personal use" suggests that the US citizen doesn't intend
> >to distribute
> >the program, but only use it while abroad. You need an export license
> >to distribute crypto -- that's covered by the rest of EAR.
> 
> I understand that, but once you are out of the States, you are no longer bound
> by the the country's laws...

That might make sense, but it isn't true.

        paul

------------------------------

From: [EMAIL PROTECTED] (Michelle Davis)
Subject: Is the output of 3DES really pseudorandom???
Date: Tue, 03 Aug 1999 16:58:56 GMT

Can you call the output of 3DES cryptographically pseudorandom? Common
sense tells me since the cipher is effective, its output has to appear
random. But is it comparable to something generated by a decent
pseudorandom number generator? 

The question arises: Are there any properties which might distinguish
3DES output from a pseudorandomly-generated number? If I gave you two
64-bit numbers, one coming out of good pseudorandom generator, and the
other a 3DES encryption of my name, would you be able to tell the
difference? What kind of analytical technique could you use to tell
the pseudorandom string from the ciphertext?

------------------------------

From: Peter Pearson <[EMAIL PROTECTED]>
Subject: Re: CFB mode with same initialization vector
Date: Tue, 03 Aug 1999 09:26:39 -0700

[EMAIL PROTECTED] wrote:
> 
> In article <[EMAIL PROTECTED]>,
>   Peter Pearson <[EMAIL PROTECTED]> wrote:
> > Daniel Vogelheim wrote:
> > >
> > > why is encryption in CFB mode insecure, if you use the same
> > > initialization vector multiple times?
> >
> > The danger is that you might encrypt plaintexts whose
> > beginnings are identical, thereby producing ciphertexts
> > whose beginnings are identical. It is not respectable
> > for an encryption system to reveal the fact that messages
> > X and Y have the same beginning, even if the system doesn't
> > reveal what that beginning is.
> >
> > If some convention in your plaintext guarantees that
> > the first block of plaintext will be different every
> > time, the system is as strong as the underlying block
> > cipher, even with fixed IV. (Corrections, you other guys?)
> 
> Not quite.  If the first two plaintext (resp. ciphertext) blocks
> of two different messages are P1 and P1' (resp. C1 and C1') then
> with the same IV used you'll get C1 XOR C1' = P1 XOR P1' thus
> leaking lots of info about the first plaintext blocks.

Eeek! Dead right! All this time I was reading "CBC" for "CFB".

- Peter

------------------------------

From: [EMAIL PROTECTED]
Subject: Re: Virtual Matrix Encryption
Date: Tue, 03 Aug 1999 17:28:12 GMT

In article <[EMAIL PROTECTED]>,
  "Douglas A. Gwyn" <[EMAIL PROTECTED]> wrote:
> [EMAIL PROTECTED] wrote:
> > DES for example was thought to provide 56-bit key strength until
> > differential analysis broke all 16 rounds ...
>
> What, pray tell, is "56-bit key strength"?

I dunno, a way of saying you have to guess 56 bits to get the
message.... I don't know how to better say it.

> DES has not been publicly reported as broken in practice with
> anything other than brute-force search of the key space.  The
> so-called "differential cryptanalysis" is not a practical attack.

Linear analysis has been done, although it is hardly practical.

Tom
--
PGP key is at:
'http://mypage.goplay.com/tomstdenis/key.pgp'.
Free PRNG C++ lib:
'http://mypage.goplay.com/tomstdenis/prng.html'.


Sent via Deja.com http://www.deja.com/
Share what you know. Learn what you don't.

------------------------------

From: [EMAIL PROTECTED] (Richard Herring)
Subject: Re: Help please (WWI/WWII ciphers)
Date: 3 Aug 1999 15:43:28 GMT
Reply-To: [EMAIL PROTECTED]

In article <7o2ggc$fj0$[EMAIL PROTECTED]>, [EMAIL PROTECTED] wrote:

> The allies (more specifically mathematicians in britain) broke the
> original and naval Enigma machines.  Those might be what you are
> looking for.

The input and output of Enigma consisted entirely of letters A-Z.


-- 
Richard Herring      | <[EMAIL PROTECTED]> 

------------------------------

From: [EMAIL PROTECTED] (Patrick Juola)
Subject: Re: the defintion of Entropy
Date: 3 Aug 1999 12:07:04 -0400

In article <[EMAIL PROTECTED]>, Douglas A. Gwyn <[EMAIL PROTECTED]> wrote:
>Patrick Juola wrote:
>> If he wants to call an aperiodic sequence a sequence of infinite
>> period, why not let him?
>
>If he wants to call blue "deep red", why not let him?
>Because it is an incorrect application of established terminology,
>that's why.

But it's also an established "incorrect application"; I've heard the
term "infinite period" used for aperiodic sequences more often than
I've heard the word aperiodic...

        -kitten

------------------------------

From: [EMAIL PROTECTED] (Andras Erdei)
Subject: Re: With all the talk about random...
Date: Tue, 03 Aug 1999 15:57:38 GMT

Jim Felling <[EMAIL PROTECTED]> wrote:

>It is IMPOSSIBLE to do.  Quantum phenomena are FUNDAMENTALLY unpredicatble,
>and indeterminate.  There are physical quantities such that the
>error_in_measurment_Q1* error_in_measurment_Q2  >= fixed constant.
>
>This results in those phenomena being FUNDAMENTALLY indeterminate.

Isn't it just a model? 

[Which means that those phenomena are not necessarily "FUNDAMENTALLY
indeterminate" (although personally i'd like them to be such).]

  Br

  Andras Erdei
  [EMAIL PROTECTED]


------------------------------

From: Medical Electronics Lab <[EMAIL PROTECTED]>
Subject: Re: Sufficiently Random numbers
Date: Tue, 03 Aug 1999 12:29:31 -0500

vincent wrote:
> If I have to use a RRNG, where can I find one (buy one or how do I write
> one).
> I've heard about one which could use the variation of a disk drive
> motor's speed caused by Air turbulence.
> 
> I really need a good Random number generator (cryptographically secure
> as well as quick) to generate a lot of keys.
> 
> Thanks for any answers (practical if possible).

You can buy RS232 port RNG's from several vendors.  If you want
to have fun and build your own, you can find a few papers floating
around the net.  I wrote up one a few months ago, check out
http://www.terracom.net/~eresrch and look for the blue /dev/random.

Patience, persistence, truth,
Dr. mike

------------------------------

From: [EMAIL PROTECTED]
Subject: Re: Sufficiently Random numbers
Date: Tue, 03 Aug 1999 18:40:11 GMT

<snip>

your requirements are then

1.  Statisitically sound (no word is more probable then 2^-k)
2.  Cryptographically secure
3.  Fast
4.  Large state

I would check out either a HASH in countermode (see Applied Crypto for
an example using MD5) or Yarrow (www.counterpane.com).

Simple things like Additive Generators (Fibonacci) fill in #1, #3 and
#4 but not #2.  C's rand only fills #1 and #3.

You could also seed a additive generator with some 'unpredictable' info
(i.e gather data hash it and use as state).  Then hash 2n bits of PRNG
output (n is the number of bits in the output).  use the hash output.

Assuming the hash is secure and the initial state is
unbiased/unpredictable this would be secure.  This means you only need
to fill the state once.  To fill the state you could use the mic adc.
Assign 1 mili-bit to the input.  If you need 256 bytes (generator with
about 64 32-bit words) you need 4096000 bits (2048 bits in the state,
and since we are using 2n as the input to the hash...).  You would have
to sample (at 8khz) for 8.5 minutes ...

Just a crazy idea...  I would use two different additive generators and
xor them together ((63, 1, 0) and (58, 19, 0) are co-prime in length)
they would require 484 bytes or 16.1 minutes of audio ...

Tom


Sent via Deja.com http://www.deja.com/
Share what you know. Learn what you don't.

------------------------------

From: [EMAIL PROTECTED] (Greg Comeau)
Crossposted-To: alt.folklore.computers,alt.comp.lang.learn.c-c++,comp.lang.c++
Subject: Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big is a 
Byte?)
Date: 3 Aug 1999 13:31:03 -0400
Reply-To: [EMAIL PROTECTED]

In article <7o1ivd$sd6$[EMAIL PROTECTED]> [EMAIL PROTECTED] writes:
>In article <6bMo3.168$[EMAIL PROTECTED]>,
>  [EMAIL PROTECTED] (Peter Seebach) wrote:
>> In article <7o027o$u61$[EMAIL PROTECTED]>,  <[EMAIL PROTECTED]>
>wrote:
>> >C's char != byte.
>>
>> True in many cases, but not in C or C++.  In both language
>specs, 'byte' means
>> 'char'.
>
>That's not true.  There is no definition of 'byte' in ANSI C.  sizeof()
>returns the length of 'chars' it requires to store the object.

I know that byte is defined in ANSI C, so that's not true.
I'm certain it will be in the index if you want to look it up.

- Greg
-- 
       Comeau Computing, 91-34 120th Street, Richmond Hill, NY, 11418-3214
     Producers of Comeau C/C++ 4.2.38 -- New Release!  We now do Windows too.
    Email: [EMAIL PROTECTED] / Voice:718-945-0009 / Fax:718-441-2310
                *** WEB: http://www.comeaucomputing.com *** 

------------------------------

From: [EMAIL PROTECTED]
Subject: Re: Is the output of 3DES really pseudorandom???
Date: Tue, 03 Aug 1999 18:48:45 GMT

In article <[EMAIL PROTECTED]>,
  [EMAIL PROTECTED] (Michelle Davis) wrote:
> Can you call the output of 3DES cryptographically pseudorandom? Common
> sense tells me since the cipher is effective, its output has to appear
> random. But is it comparable to something generated by a decent
> pseudorandom number generator?

Well sorta...

>
> The question arises: Are there any properties which might distinguish
> 3DES output from a pseudorandomly-generated number? If I gave you two
> 64-bit numbers, one coming out of good pseudorandom generator, and the
> other a 3DES encryption of my name, would you be able to tell the
> difference? What kind of analytical technique could you use to tell
> the pseudorandom string from the ciphertext?
>

is '17' any more random then '2333333333333456' ?  That question is
really moot.  You should ask 'is a stream of n outputs distinguishable
from random?'.

Generally you can use an encryption method as a PRNG but not for long.
The basic method is to:

I = 0

1.  K = H(M)
2.  output = Ek(I)
3.  I = I + 1
4.  if (need more outputs) and (I < threshold) goto 2
5.  if (need more outputs) goto 1

Where I is a global counter, and M is some unpredictable input (mouse,
keyboard and disk activity for example).  If you run the counter to
long with the same key it won't be random since the previous outputs
will not appear again (it's a function rememeber).  Generally if your
threshold is small enough (say 1024) out of 2^64 possible outputs it
will be good enough.

For example after 512 outputs you have a 1 in (2^64 - 512) chance of
guessing the next output ...

BTW 3des was used in Yarrow by www.counterpane.com

Tom
--
PGP key is at:
'http://mypage.goplay.com/tomstdenis/key.pgp'.
Free PRNG C++ lib:
'http://mypage.goplay.com/tomstdenis/prng.html'.


Sent via Deja.com http://www.deja.com/
Share what you know. Learn what you don't.

------------------------------

From: [EMAIL PROTECTED] (John Savard)
Subject: Re: Question about Information Theory
Date: Tue, 03 Aug 1999 19:04:35 GMT

Coms 1003 <[EMAIL PROTECTED]> wrote, in part:

>The question is this: does it follow directly from information theory
>that, given any encoding of the symbols of the sources into binary,
>transmission of one bit cannot reduce the entropy by more than one?

No, you can choose a coding that will on occasion - but not on average
- break this rule.

For example:

Say I have letters, chosen at random from A to Z, to transmit. All
these letters are equally probable.

But I code them so that 0 stands for the letter Q, and six-bit codes
starting with 1 stand for all the other letters.

If Q happens to come up, and I transmit a 0, the uncertainty has been
reduced by a full letter for the price of a bit.

John Savard ( teneerf<- )
http://www.ecn.ab.ca/~jsavard/crypto.htm

------------------------------

From: Ross Smith <[EMAIL PROTECTED]>
Crossposted-To: alt.folklore.computers,alt.comp.lang.learn.c-c++,comp.lang.c++
Subject: Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big 
Date: Mon, 02 Aug 1999 10:55:17 +1300

Martin Ambuhl wrote:
> 
> From the [C] standard (ISO 9899:1990)
> 
> 3.4 byte. The unit of data storage large enough to hold any member of
> the basic character set of the execution environment.  It shall be
> possible to express the address of each individual byte of an object
> uniquely.  A byte is composed of a contiguous sequence of bits, the
> number of which is implementation-defined.

Note that, elsewhere in the standard, this number is required to be at
least 8.

> The least significant bit is
> called the low-order bit; the most significant bit is called the
> high-order bit.

--
Ross Smith <[EMAIL PROTECTED]> The Internet Group, Auckland, New Zealand
========================================================================
The good news, according to the FCC, is that television viewing won't be
interrupted by the Y2K problem. The bad news, according to the rest of
us, is that television viewing won't be interrupted by the Y2K problem.
                               -- Jonathan Erickson in Dr Dobb's Journal

------------------------------

From: [EMAIL PROTECTED] (JPeschel)
Subject: Re: NORTON Diskreet Decrypt Help me
Date: 03 Aug 1999 18:24:59 GMT

>"Vasiliy Khalak" <[EMAIL PROTECTED]> writes:

>I need decrypt of Diskreet's disk.
>Can you help me? I search all information about this but I can't find the
>compiled program which do it self.
>
>Thank for your time & your help.

Try Pavel Semjanov's site.

Joe


__________________________________________

Joe Peschel 
D.O.E. SysWorks                                 
http://members.aol.com/jpeschel/index.htm
__________________________________________


------------------------------

From: [EMAIL PROTECTED] (Guenther Brunthaler)
Subject: Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big  is  a 
Byte?)
Date: Tue, 03 Aug 1999 19:15:56 GMT

On Tue, 03 Aug 1999 04:44:35 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
wrote:

>It's essentially the subset of <inttypes.h> that pertains to the
>language only; so it lacks declarations for the hosted library
>functions and printf/scanf formats.  <inttypes.h> will #include
><stdint.h>

Which means that <inttypes.h> is mainly for ANSI-C and <stdint.h> is
the core that contains the actual typedefs.

Is there also a <stdint>, <inttypes> or <cstdint> planned for C++?

And if it is, will the stdint-types be wrappen in namespace std?

>(i.e., for every type that is supported by the implementation).

Then it seems to be OK that I have added a #define UINT_FAST16_MAX
manually to inttypes.h. I'm relieved, because I was really in doubt.

>No, a conforming implementation can use twos-complement,
>ones-complement, or signed-magnitude representation for integers,
>optionally with padding bits that do not form part of the value.

Thanks again for your clarification.

>It has been a long time since Microsoft has sent a representative
>to J11/WG14.  On the other hand, they do seem to eventually track
>the C and C++ standards.

Then let's hope that they will finally conform to those standards one
day...

>An upper limit would probably be a wordsize capable of counting
>every particle in the universe at every resolvable moment of time,
>so 128 bits is getting there.

And 128 bits would also allow to represent an OSF UUID (or Microsoft
GUID).

>Note that a word size of > 256 bits forces one to denote the
>bit-within-word using a number bigger than an octet, which may
>give the engineers pause.

It seems to be an upper limit with regard to several issues, I agree.


Greetings,

Guenther
--
Note: the 'From'-address shown in the header is an Anti-Spam
fake-address. Please remove 'nospam.' from the address in order
to get my real email address.

In order to get my public RSA PGP-key, send mail with blank body
to: [EMAIL PROTECTED]
Subject: get 0x2D2F0683

Key ID: 2D2F0683, 1024 bit, created 1993/02/05
Fingerprint:  11 71 47 2F AF 2F CD F4  E6 78 D5 E5 3E DD 07 B5 

------------------------------

From: [EMAIL PROTECTED] (Greg Comeau)
Crossposted-To: alt.comp.lang.learn.c-c++,comp.lang.c++,microsoft.public.vc.language
Subject: Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big  is  a 
Byte?)
Date: 3 Aug 1999 15:21:35 -0400
Reply-To: [EMAIL PROTECTED]

In article <[EMAIL PROTECTED]> Martin Ambuhl <[EMAIL PROTECTED]> 
writes:
>
>
>"Lame K. Irony" wrote:
> 
>> By the way, I'd like to point out the obvious fact that if the word "byte"
>> did NOT mean an eight bit binary number, then it would necessary for us to
>> create a word that DOES have that meaning, since there is certainly a need
>> for such a word. In my opinion, the fact that no other such word exists is
>> ample evidence that "byte" fits the bill.
>
>Next time you get involved in a thread, stay awake.  There have been
>numerous uses of "octet" in this thread.  Somehow people have been using
>a word that that does not exist.
>
>If you think "byte" works with the meaning "8-bits", explain what the
>PDP-10 insruction LoadBytePointer is supposed to do when someone tries
>to use one of the other 35 allowed sizes (any size 1-36) works.  

I think we can help each other here, and still avoid "insults"
like "stay away".  Please reconsider such.  Thanks.

- Greg
-- 
       Comeau Computing, 91-34 120th Street, Richmond Hill, NY, 11418-3214
     Producers of Comeau C/C++ 4.2.38 -- New Release!  We now do Windows too.
    Email: [EMAIL PROTECTED] / Voice:718-945-0009 / Fax:718-441-2310
                *** WEB: http://www.comeaucomputing.com *** 

------------------------------

From: "Kai O'Yang" <[EMAIL PROTECTED]>
Crossposted-To: sci.crypt.research,de.comp.security
Subject: Postgraduate Research Scholarships
Date: 3 Aug 1999 18:46:41 -0000



                    Monash University, Peninsula Campus
        The Peninsula School of Computing and Information Technology
                   http://www.pscit.monash.edu.au/

               Postgraduate Research Scholarships in Computing
               ===============================================

The Peninsula School of Computing and Information Technology is part of the
Faculty of Information Technology at Monash, and is located on
the Peninsula Campus (Frankston, Melbourne, Australia). The School has teaching
and research programmes covering major areas of computing, with a particular
focus on Network Computing. The School offers the following postgraduate
research programmes:

      * Master of Computing (Research), and
      * Doctor of Philosophy.

Graduates with good prerequisites (H1 or H2A honours degree in
Australia, or the equivalent from an overseas institution) in computing
or a related area are invited to apply to study in these programmes.

The School provides a friendly and supportive environment. It has strong
collaborative relationships with industrial partners including SUN Microsystems.
Recently, the School has been recognized as the host of the first Authorized
Academic Java Campus in the Asia-Pacific region.
Staff in the School conduct research in applied computing, with an emphasis
on Network Computing. Most of the School's current research activities
are carried out in the following areas and their interactions within
the Network Computing initiative:

      * Computer and network Security:
            cryptography, network security, digital cash and secure
            electronic commerce, digital watermarking and copyright protection,
            intrusion detection, secure mobile software agents, smart card
            security, secure software engineering;
      * Concurrent and Distributed Object Systems:
            Software development methodologies for distributed and concurrent
            object systems, middleware platforms, Concurrent and Distributed
            languages, Internet software development;
      * Health Informatics:
            integration of health information systems, domain models and
            development workbenches for health/medical information systems;
      * Information Systems Engineering:
            method engineering, systems development methodologies for
            distributed information systems;
      * Multimedia and Information Management:
            web-based computer education, multimedia education systems,
            hypertext-oriented information retrieval, synchronization and
            resource management issues in distributed multimedia systems;
      * Software Systems:
            enterprise information architectures,
            integration and composition of software systems
            (components, architectures, patterns and frameworks),
            software engineering tools and environments.

Potential candidates are encouraged to apply to study in any of these areas.

The University has a range of scholarships available to qualified candidates.
They include the Australian Postgraduate Award, the Monash Graduate
Scholarship, and the Overseas Postgraduate Research Scholarship.
The School also offers a number of research scholarships to selected full-time
candidates, and the stipend is comparable to the Monash Graduate Scholarship
(approx. A$16,000 p.a.). In addition, teaching and research
assistantships may be available to appropriately qualified applicants.

The application deadline is 28 October 1999. For further information and
application forms, please contact

        The Postgraduate Studies Coordinator
        The Peninsula School of Computing and Information Technology
        Monash University, McMahons Road
        Frankston, Vic 3199, Australia

        Phone: +61 3 9904 4287
        Fax:   +61 3 9904 4124
        Email: [EMAIL PROTECTED]
        URL:   http://www.pscit.monash.edu.au/

When contacting the School, potential applicants are advised to provide

        (1) an outline of their intent (e.g. which degree, which area),
        (2) a detailed curriculum vitae,
        (3) a copy of their undergraduate and postgraduate transcripts, and
        (4) an indication of whether or not they are Australian citizens or
            permanent residents.

This information will help the School to provide the most appropriate advice
to the applicants.
============================================================================

------------------------------

From: Greg <[EMAIL PROTECTED]>
Subject: Re: [Q] Why is pub key cert. secure & free from spoofing?
Date: Tue, 03 Aug 1999 19:32:02 GMT


>... They have more stringent ones (eg requiring a
> signed application from a JP,) up to submitting a whole a raft of
documents
> attesting to the valididty of the relationship between the key and
the person.
> (Those cost serious money).

And all of these are still vulnerable to a disguntled employee of the
CA site.

--
The US is not a democracy - US Constitution Article IV Section 4.
Democracy is the male majority legalizing rape.
UN Security Council is a Democracy.  NO APPEALS!  Welcome to the NWO.
Criminals=Crime.  Armies=Tyranny.  The 2nd amendment is about tyranny.


Sent via Deja.com http://www.deja.com/
Share what you know. Learn what you don't.

------------------------------

From: [EMAIL PROTECTED] (Guenther Brunthaler)
Crossposted-To: alt.comp.lang.learn.c-c++,comp.lang.c++,microsoft.public.vc.language
Subject: Re: How to write REALLY PORTABLE code dealing with bits (Was: How Big  is  a 
Byte?)
Date: Tue, 03 Aug 1999 18:56:48 GMT

On Tue, 03 Aug 1999 04:47:17 GMT, "Douglas A. Gwyn" <[EMAIL PROTECTED]>
wrote:

>> Sure, and following this, we will discuss the correct abbreviation of
>> "[T]ernary dig[IT]".
>
>It's usually called a "trit"; sorry about that.

Spoiler... :-)


Greetings,

Guenther
--
Note: the 'From'-address shown in the header is an Anti-Spam
fake-address. Please remove 'nospam.' from the address in order
to get my real email address.

In order to get my public RSA PGP-key, send mail with blank body
to: [EMAIL PROTECTED]
Subject: get 0x2D2F0683

Key ID: 2D2F0683, 1024 bit, created 1993/02/05
Fingerprint:  11 71 47 2F AF 2F CD F4  E6 78 D5 E5 3E DD 07 B5 

------------------------------

From: Greg <[EMAIL PROTECTED]>
Subject: Re: [Q] Why is pub key cert. secure & free from spoofing?
Date: Tue, 03 Aug 1999 19:27:39 GMT


> When you get
> a copy of Netscape or Lotus notes, it includes some
> top-level CA public keys.  If you think the distribution
> may have been altered, you can take steps on several
> levels to check.

If Netscape sent me a "Netscape trust worthy CA", I would ask, "Do I
know everyone well enough in Netscape that I can trust this document
they sent?  Can I trust that this document has not been altered at the
print shop?"

In the end, CA are an attempted infrustructer to solve an e-commerce
problem.  Money is being poured into a solution of little merit because
others stand to make money if it is used by the populace; and it is the
only solution that has half a chance right now of being accepted, even
with its weaknesses.



--
The US is not a democracy - US Constitution Article IV Section 4.
Democracy is the male majority legalizing rape.
UN Security Council is a Democracy.  NO APPEALS!  Welcome to the NWO.
Criminals=Crime.  Armies=Tyranny.  The 2nd amendment is about tyranny.


Sent via Deja.com http://www.deja.com/
Share what you know. Learn what you don't.

------------------------------


** FOR YOUR REFERENCE **

The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:

    Internet: [EMAIL PROTECTED]

You can send mail to the entire list (and sci.crypt) via:

    Internet: [EMAIL PROTECTED]

End of Cryptography-Digest Digest
******************************

Reply via email to