Cryptography-Digest Digest #753, Volume #10 Fri, 17 Dec 99 10:13:01 EST
Contents:
Re: More idiot "security problems" (Xcott Craver)
Re: Keystrokes monitored/encryption useless ([EMAIL PROTECTED])
Re: ARC4 cipher... (Pelle Evensen)
Reducing Key Sizes ("Adam Pridmore")
Re: Enigma - theoretical question (John Savard)
Breaking a cipher. ("jim")
Euclid Algorithm ("Miryadi")
Re: The Cracking of SecurityPlus! 4.32 (Paul Crowley)
Re: Ellison/Schneier article on Risks of PKI ([EMAIL PROTECTED])
DES key safety ("Tom Pedersen")
Re: 8192bit Encrypt - Easy ! (SCOTT19U.ZIP_GUY)
Re: Keystrokes monitored/encryption useless (SCOTT19U.ZIP_GUY)
Re: Deciphering without knowing the algorithm? (SCOTT19U.ZIP_GUY)
Re: Cryptanalysis (SCOTT19U.ZIP_GUY)
Re: More idiot "security problems" (SCOTT19U.ZIP_GUY)
Re: Reducing Key Sizes (SCOTT19U.ZIP_GUY)
Re: Off topic -- 4 year old (Michael Groh)
----------------------------------------------------------------------------
From: [EMAIL PROTECTED] (Xcott Craver)
Subject: Re: More idiot "security problems"
Date: 17 Dec 1999 10:26:17 GMT
David Wagner <[EMAIL PROTECTED]> wrote:
>Xcott Craver <[EMAIL PROTECTED]> wrote:
>I like Bruce Schneier's sound byte: "Kindergarten Crypto".
>I think that conveys the essence especially nicely...
The problem with this is, sadly, that the term was used to
describe an attempt at crypto which was many notches above this.
MicroSoft may have messed up their protocols, but at least
they picked strong cryptosystems as building blocks.
If what MicroSoft did was "Kindergarten Crypto," then this
is ... "toddler" crypto? "Embryo" crypto? "Glint in the
milkman's eye" crypto?
But I was looking for the more general term for a coder
developing a hilariously awful algorithm for a basic problem
that can only come from (a) complete ignorance of existing
algorithms; (b) the arrogance to not bother to pick up a book,
and sometimes (like our alt.2600 visitor) enough arrogance
to assume that their first attempt is a world-beater;
(c) the lack of some general common sense about the speed of
computers---what's "slow," what's "fast," what's a "large number";
and (d) the ethical numbness to put the technology in something
human beings will use.
A term which combines the false sense of expertise, the
amazing cluelessness, and the danger to others. Like a manager
of a hardware superstore who never heard of firebrick
(fireproof stuff you use as a work surface for welding), but
tells you to try some of this galvanized sheet metal instead.
-Scott
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: Keystrokes monitored/encryption useless
Date: Fri, 17 Dec 1999 11:17:40 GMT
In article <[EMAIL PROTECTED]>,
[EMAIL PROTECTED] (Johnny Bravo) wrote:
> On 16 Dec 1999 22:13:17 GMT, [EMAIL PROTECTED] (Keith A Monahan)
> wrote:
>
> >First off, if they think they can prevent some pirate from
distributing
> >DIRT around to everyone and their brother, they are crazy. I can't
> >beleive I haven't seen a pirated copy yet. Perhaps I'll take a look
:)
>
While I hate to add to a thread that really belongs in alt.privacy, no
one seems to be complaining :-)
I think the best joke on uncle sam would be, the first person to
capture this code - anonamously post it to somewhere like alt.privacy
and if you can, post a patch to trace where it was supposed to send its
info. Seems turnabout is only fair :-)
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: [EMAIL PROTECTED] (Pelle Evensen)
Subject: Re: ARC4 cipher...
Date: 17 Dec 1999 11:55:04 GMT
Andrej Madliak ([EMAIL PROTECTED]) wrote:
: Hi!
: Has anybody heard of
: ARC4 stream cipher (w/128-bit key) and/or about its security and
: attacks against it?
It's "Alleged RC4", something that seemingly behaves identically to
RSA's RC4 stream cipher.
http://burtleburtle.net/bob/rand/isaac.html
Source and more comments can be found here;
ftp://ftp.funet.fi/pub/crypt/cryptography/symmetric/rc4/
/Pell
------------------------------
From: "Adam Pridmore" <[EMAIL PROTECTED]>
Subject: Reducing Key Sizes
Date: Fri, 17 Dec 1999 12:13:33 -0000
Does anyone know if there are any security issues in symmetric algorithms if
the key size is reduced (eg making the last x bits of the key constant),
other than reducing the number of available keys. (ie Brute force is still
the easiest way to break it).
Could this be very dependant on the algorithm chosen?
TIA
------------------------------
From: [EMAIL PROTECTED] (John Savard)
Subject: Re: Enigma - theoretical question
Date: Fri, 17 Dec 1999 12:16:54 GMT
On Thu, 16 Dec 1999 17:59:37 -0800, Neil Bell <[EMAIL PROTECTED]>
wrote:
>Would this be a reasonably secure way to exchange very private
>financial and investment tips using e-mail??
The Enigma had the problem that no letter enciphers to itself, so
sending a message by that method, even with proper precautions (as you
correctly outline), does potentially leak information. Using "modern"
techniques, i.e., a copy of PGP, is much safer.
------------------------------
From: "jim" <[EMAIL PROTECTED]>
Subject: Breaking a cipher.
Date: 17 Dec 1999 12:44:55 GMT
I'm only a newbie to the world of cryptography and I was wodering about
breaking a cipher. Is it a hard task, or is it just reversing the cipher
and using as many keys as possible?
------------------------------
From: "Miryadi" <[EMAIL PROTECTED]>
Subject: Euclid Algorithm
Date: Thu, 16 Dec 1999 03:22:40 +0700
Hello, all
What is the best way of implementing Euclid Algorithm,
regarding its time complexity, using recursive or iterative method?
Is there any web site that give information on this topic?
Best Regards
-- Yadi --
------------------------------
From: Paul Crowley <[EMAIL PROTECTED]>
Subject: Re: The Cracking of SecurityPlus! 4.32
Date: 17 Dec 1999 08:52:50 -0000
[EMAIL PROTECTED] (Troed) writes:
> >Part of A. of Casimir's essay, "The Cracking of Security Plus,"
> >is now up on my web site. Parts B and C will soon follow.
>
> Nothing on Kremlin's implementation of IDEA? :) I must confess to
> having forgot my password for a file I encrypted long ago ...
There's always brute force - you know the kinds of passwords you tend
to choose, so how hard do you think it could be to write a brute force
cracker for them?
I know that while my PGP passphrase is fairly high entropy, the
passwords I tend to use on (say) Web sites tend to be only around 2^23
or so - if I used such a password to encrypt a file, it would probably
take longer to write the cracker than it would to run it.
--
__
\/ o\ [EMAIL PROTECTED] Got a Linux strategy? \ /
/\__/ Paul Crowley http://www.hedonism.demon.co.uk/paul/ /~\
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: Ellison/Schneier article on Risks of PKI
Date: Fri, 17 Dec 1999 13:30:28 GMT
> What about, using multiple RAs for a single CA. I think that adds
> significant value, for example the RA could be in London, but could
have RAs
> in London, Paris , Madrid, Sydney.... in an organisation with offices
spread
> geographically. There is some assumtion of the RA's and CA all being
on the
> same side.... but this is politics.
> In fact, I think the CA->RAs model is quite useful.
> As is the CA->CAs->RAs model (although this makes the root's Key a
bit of a
> target).
>
> tim
In the CA->RA model or the CA->CA->RA model, there is one root, which
if their key is compromised and an attacker issues fake certificates,
the root will NEVER know, because all they do is issue certificates,
they can't verify certificates that are floating around in the system.
This is what I see as the major problem of PKI: A fake certificate
signed with a legit (compromised) key, and the CA not being aware that
their key is compromised.
Since PKI is based on RSA, it shouldn't be too difficult to get a CA to
sign rouge certificates to aid chosen attacks in RSA.
DW
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: "Tom Pedersen" <[EMAIL PROTECTED]>
Subject: DES key safety
Date: Fri, 17 Dec 1999 14:51:52 +0100
Hi
Is DES safe towards the key? I mean if you have the cleartext and the
ciphertext could you derrive the key? Theory and practise is two different
issues, so actually I'm asking two questions.
Tom
------------------------------
From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: 8192bit Encrypt - Easy !
Date: Fri, 17 Dec 1999 15:12:37 GMT
In article <[EMAIL PROTECTED]>, [EMAIL PROTECTED] (Johnny Bravo)
wrote:
>On Fri, 17 Dec 1999 00:18:52 -0000, "Glen Bridgland"
><[EMAIL PROTECTED]> wrote:
>
>>Please read the document and express your thoughts.
>
> LOL, sure, you did ask for it.
>
>1). Encrypt any Media on a Windows 9x Operating System.
>
> What would be the point of not including this. "We can only encrypt
>..doc files!"
>
>2). Provides Secure Transfer over a Network with an Encryption rate of
>8912bits (DES - Sapphire II).
>
> And the point of all this computationally expensive overkill is?
>There are applications where you just don't have time to use 8912 bits
>of DES on the network.
>
>3.) Compression Support Applied.
>
> Mr DS is going to insult you and use bad language if you don't use
>one-to-one compression! <grin>
No need to inslut him yet. He may never really given any thought
of what kind of compression should go with encryption. But my guess
is that he has been lead down the rose garden path by the phony
BS crypto gods and what kind of compression one should use with
crypto. I would hope if it is for real that he would use one to one
compression when he realizes that it is the only compression that
does not add information that breaks a file. But I could find now
mention of what compression was used at his site.
>
>4). Multi Password Locking and Encryption Routines.
>
> This is more than a bit vague, is the program password locked, are
>the files locked with multiple passwords, can each file be unlocked
>with more than one password? Multiple encryption? Why in the hell
>would you want more than 8912 bits of some DES variant?
>
>5). Supports more than Thirty of the Best Checksum, Hash, Cipher and
>DES Algorithm Types.
>
> TEA is on the list, and is hardly the BEST of anything.
>
>6). Simple, Non Complexed Graphic User Interface.
>
> Just like many other crypto programs we could mention. Hell, there
>is even a GUI for PGP 2.6.3.
>
>
> Now we move on to the Snake Oil portion of the Show.
>
>"It Must be the Best Value Encryption Product on the Market For
>Security." and "I feel confident that it is One of the best, if not
>the best, Encryption Program available at its price in public
>circulation."
>
> We can get good crypto for free. Since your product is not free,
>this is a lie, next.
>
>"I would claim this provides an encryption process that would take
>decades to break, if posssible at all..."
>
> No proof offered that the multiple encryption is any stronger than
>conventional encryption. And the author suggests using a "simple
>password phrase" for protection, no matter the encryption, it is only
>as strong as the passphrase used to protect it.
>
>"Can you break the Nanosim Code ? Be the first in the World. What does
>the text message say ?"
>
> Wow, a stupid crypto challenge, without even a prize, or a point it
>seems.
>
>"WHEN IT COMES TO ENCRYPTION WE KICK ARSE!"
>
> I don't really think that this statement needs further explanation.
>
> Johnny Bravo
>
>
David A. Scott
--
SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE
http://www.jim.com/jamesd/Kong/scott19u.zip
Scott famous encryption website NOT FOR WIMPS
http://members.xoom.com/ecil/index.htm
Scott rejected paper for the ACM
http://members.xoom.com/ecil/dspaper.htm
Scott famous Compression Page WIMPS allowed
http://members.xoom.com/ecil/compress.htm
**NOTE EMAIL address is for SPAMERS***
------------------------------
From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: Keystrokes monitored/encryption useless
Date: Fri, 17 Dec 1999 15:23:52 GMT
In article <[EMAIL PROTECTED]>, [EMAIL PROTECTED] (Bauerda)
wrote:
>> Take a look at the latest article from Privacytimes.com at
>>http://www.privacytimes.com/dirt_8_17.htm
>> The program is called DIRT and it records all your keystrokes. When
>>you're online, it sends them to the receipient.
>> This means that your keystrokes made while making your encryption
>>keys are now worthless! How would one get around this if this software
>>got into the wrong hands?
>
> Before I upgraded to Windows, I had my startup files set so that they traced a
"upgraded to Windows" if this is nat a bastardtisetion of the English
language I don't know what is.
>few interrupts (DOS, disk access, and keyboard) and checked most of the
>interrupt table against stored results. While this is harder under Windows, it
>is still relatively easy to get a program which looks at the devices and
>threads running (hidden or not).
>
>David Bauer
David A. Scott
--
SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE
http://www.jim.com/jamesd/Kong/scott19u.zip
Scott famous encryption website NOT FOR WIMPS
http://members.xoom.com/ecil/index.htm
Scott rejected paper for the ACM
http://members.xoom.com/ecil/dspaper.htm
Scott famous Compression Page WIMPS allowed
http://members.xoom.com/ecil/compress.htm
**NOTE EMAIL address is for SPAMERS***
------------------------------
From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: Deciphering without knowing the algorithm?
Date: Fri, 17 Dec 1999 15:20:03 GMT
In article <[EMAIL PROTECTED]>, "Douglas A. Gwyn" <[EMAIL PROTECTED]> wrote:
>wtshaw wrote:
>> He explained that he primarilly an assembly programmer. To him what he
>> writes makes perfect sense. I remember the struggle to get mayself to
>> adopt a different programming style years ago, but it does not mean that
>> what I did before was wrong, as it worked.
>
>Programs have several purposes, only *one* of which is to "work".
>Another, very relevant in this context, is to communicate with a
>future (maintenance) programmer. Some code is easy for another
>competent programmer to fully comprehend, but much code is awful.
>There are many books, several of them very good, on programming
>style (as opposed to just getting a program to appear to "work").
When you work with aircraft code you find out that few socalled
experts know shit about good code. Many simiple and easy to follow
code is entirely worng and can give maintance coders a head ache or
worse yet is so rambling that it does not work. The best coding is what
one writes for oneself. If you code as straight forward as you can
which is what I do then don't worry if others can follow it. The proof is
in the pudding.
David A. Scott
--
SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE
http://www.jim.com/jamesd/Kong/scott19u.zip
Scott famous encryption website NOT FOR WIMPS
http://members.xoom.com/ecil/index.htm
Scott rejected paper for the ACM
http://members.xoom.com/ecil/dspaper.htm
Scott famous Compression Page WIMPS allowed
http://members.xoom.com/ecil/compress.htm
**NOTE EMAIL address is for SPAMERS***
------------------------------
From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: Cryptanalysis
Date: Fri, 17 Dec 1999 15:14:44 GMT
In article <83cij7$dvj$[EMAIL PROTECTED]>, Scott Fluhrer
<[EMAIL PROTECTED]> wrote:
>In article <83arld$2ga4$[EMAIL PROTECTED]>,
> [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY) wrote:
>>In article <839t3o$96d$[EMAIL PROTECTED]>, [EMAIL PROTECTED] wrote:
>>>I'm doing a paper on Cryptography and It's Affect On The Information
>>>Age. It's mostly about crypto in regards to current US law, however,
>>>I have a brief primer on crypto in the first few pages. I need to
>>>source everything that is not an oppinion. I remember reading
>>>sometihng a few weeks ago about how cryptosystems are often created to
>>>meet a purpose and you wouldn't use a difficult cryptosystem to apply
>>>to a message to send info that will expire in one week.
>>>
>>>My line is "The basic theory is to make a cryptosystem which can be
>>>applied with the least amount of effort but is impractical to break
>>>before the information becomes irrelevant using the currently available
>>>equipment."
>>>
>>>I need to source that, anyone know a web page, book, magazine article,
>>>etc which covers the above? I can't remember for anything where I saw
>>>that info.
>>>
>>>I'd appreciate a quick reply.
>>>
>>
>> The problem with crypto that almost makes it an art and not a science is
>>that one can never be sure how secure a method really is. One should try to
>>use a method that is as secure as possible yet will not take to long to do the
>>encryptopm or decyption. It is quite possible systems toted as secure till
>>the sun burns out may already be broken by someone with only a few weeks
>>of effort. While some other method commonly dismissed as snake oil could
>>very well be stronger than anything out there. That is what makes crypto fun.
>
>Hey -- the above is coherent, intellegent, shows some knowledge of cryptography
>and has only 4 spelling errors.
>
>OK: Who's posting under DAS's name???
>
>
Sorry I was low on BEER
David A. Scott
--
SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE
http://www.jim.com/jamesd/Kong/scott19u.zip
Scott famous encryption website NOT FOR WIMPS
http://members.xoom.com/ecil/index.htm
Scott rejected paper for the ACM
http://members.xoom.com/ecil/dspaper.htm
Scott famous Compression Page WIMPS allowed
http://members.xoom.com/ecil/compress.htm
**NOTE EMAIL address is for SPAMERS***
------------------------------
From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: More idiot "security problems"
Date: Fri, 17 Dec 1999 15:30:14 GMT
In article <83d19s$7it$[EMAIL PROTECTED]>, [EMAIL PROTECTED] (Xcott Craver)
wrote:
>Trevor Jackson, III <[EMAIL PROTECTED]> wrote:
>>
>>There is no reason to expect crypto to be better than average in algorithm
>>research. There are lots of reasons to expect crypto to be worse than
>>average. Chief among these is the fact that the author is unable to tell,
>>without great effort, when he has failed.
>
>>But encryption is almost the exact opposite of sort(). The removal of order
>>rather then the imposition thereof. So the average coder can't
>>tell a good output from a bad one. Even an expert cryptologist requires
>>an effort to distinguish the really bad from the merely fatally flawed.
>>
>>The effect of these conditions is so predictable it ought to have a name like
>>"<Someone>'s Law of Cryptology"
>
> Bruce Schneier and Counterpane have been known to assert, in
> talks and white papers, that good crypto/security cannot be
> distinguished from bad crypto/security. I've always considered
> this "Schneier's first law."
I can see where Mr BS would make that kind of comment he thinks most
people are stupid and that only he can ass her tain which crypto is good.
>
> His second law being a remark he made at HOPE-II, which, in context,
> referred to the tendency of people to simply disable annoying or
> restrictive security measures: "The user will pick dancing pigs
> over security every time."
>
> -Scott
>
If people are stupid enough to think they are secure when they
use his crap they are picking dancing pigs over security every
time. No wonder he has such a low opinion of every one else.
>From his point of view he is laughing all the way to the bank when
every any one uses his crap.
David A. Scott
--
SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE
http://www.jim.com/jamesd/Kong/scott19u.zip
Scott famous encryption website NOT FOR WIMPS
http://members.xoom.com/ecil/index.htm
Scott rejected paper for the ACM
http://members.xoom.com/ecil/dspaper.htm
Scott famous Compression Page WIMPS allowed
http://members.xoom.com/ecil/compress.htm
**NOTE EMAIL address is for SPAMERS***
------------------------------
From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: Reducing Key Sizes
Date: Fri, 17 Dec 1999 15:34:31 GMT
In article <[EMAIL PROTECTED]>, "Adam Pridmore" <[EMAIL PROTECTED]> wrote:
>Does anyone know if there are any security issues in symmetric algorithms if
>the key size is reduced (eg making the last x bits of the key constant),
>other than reducing the number of available keys. (ie Brute force is still
>the easiest way to break it).
Of course keeping a portion of the key constand reduces the possible
set of mappings so yes this does make a it easier to break.
>
>Could this be very dependant on the algorithm chosen?
Of course it would depend on the algorithm chosen why
are you asking such obvious questions. Spit it out man
what are you driving at.
David A. Scott
--
SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE
http://www.jim.com/jamesd/Kong/scott19u.zip
Scott famous encryption website NOT FOR WIMPS
http://members.xoom.com/ecil/index.htm
Scott rejected paper for the ACM
http://members.xoom.com/ecil/dspaper.htm
Scott famous Compression Page WIMPS allowed
http://members.xoom.com/ecil/compress.htm
**NOTE EMAIL address is for SPAMERS***
------------------------------
From: [EMAIL PROTECTED] (Michael Groh)
Subject: Re: Off topic -- 4 year old
Date: Fri, 17 Dec 1999 09:53:20 -0500
> Since this could be a rather evil trick. Do you have a URL to a common news
> source on line requesting this. With this address.
Reasonable request! Here's a URL supporting the Paige Lane card request:
http://maxpages.com/prayerchapel/View_Prayer_Request
Also, from the Urban Legends page (www.snopes.com) posted by Jim
Gillogly, it appears that someone has researched this little girl's
situation and it appears legitimate.
- Mike
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
