Cryptography-Digest Digest #56, Volume #11 Sat, 5 Feb 00 22:13:02 EST
Contents:
Re: Merkle hash tree patent expired ("Roger Schlafly")
Re: Key Generation program for Windows? (Jim)
polyalphabetic substitution cipher ([EMAIL PROTECTED])
Re: NIST, AES at RSA conference (wtshaw)
Re: Jaws Technologies' L5 Data Encryption Algorithm? ("Trevor Jackson, III")
Re: Court cases on DVD hacking is a problem for all of us (Bill Unruh)
Re: Clock drift (was Intel 810 chipset Random Number Generator) ("Trevor Jackson,
III")
Re: english word list (Bill Unruh)
Re: english version of the cipherchallenge ([EMAIL PROTECTED])
Polyalphabetic en/de-cryption program ("Andersen")
This is a test. (smb)
Re: NIST, AES at RSA conference (David Wagner)
Re: How to Annoy the NSA ([EMAIL PROTECTED])
Re: NIST, AES at RSA conference ("Joseph Ashwood")
Re: english version of the cipherchallenge (Bill Unruh)
Re: How to password protect files on distribution CD (Maarten)
Random-Width Transposition Tables? ("r.e.s.")
----------------------------------------------------------------------------
From: "Roger Schlafly" <[EMAIL PROTECTED]>
Subject: Re: Merkle hash tree patent expired
Date: Sat, 5 Feb 2000 09:31:17 -0800
Paul Rubin <[EMAIL PROTECTED]> wrote in message
news:87dpfs$i2r$[EMAIL PROTECTED]...
> Hey, nobody seems to have mentioned it here, but apparently US patent
> 4,309,569 expired on September 5, 1999. This gives a somewhat clunky
> way of doing digital signatures using only conventional hash functions,
> no modular exponentiations or elliptic curves or other fancy math.
I didn't notice. Merkle hash trees do have some other applications.
I am sure there are some folks who are glad the patent has expired.
------------------------------
From: [EMAIL PROTECTED] (Jim)
Subject: Re: Key Generation program for Windows?
Date: Sat, 05 Feb 2000 18:57:02 GMT
Reply-To: [EMAIL PROTECTED]
On Sat, 5 Feb 2000 03:08:32 -0500, "cedric frost" <[EMAIL PROTECTED]>
wrote:
>Anyone know of a program for Windows 9x that generates pseudo-random
>keys/passwords? I use Counterpane's Password Safe for storing keys, but its
>password generator only produces alphanumeric results, and there are no
>claims about its randomness/security. I would like something that will help
>me generate keys using any printable character, or perhaps a customizable
>choice of characters.
Unless you need hundreds of keys, it's easier to do this on a piece
of squared paper!
--
Jim,
nordland at lineone.net
amadeus at netcomuk.co.uk
------------------------------
From: [EMAIL PROTECTED]
Subject: polyalphabetic substitution cipher
Date: Sat, 05 Feb 2000 19:01:08 GMT
Does anyone know of any tools on the internet to decipher
polyalphabetic substitution ciphers -- something that one:
- figures out how many alphabets are being used
- deciphers text accordingly.
Your help is most appreciated
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: [EMAIL PROTECTED] (wtshaw)
Subject: Re: NIST, AES at RSA conference
Date: Sat, 05 Feb 2000 12:52:30 -0600
In article <#RxkNu7b$GA.312@cpmsnbbsa03>, "Joseph Ashwood"
<[EMAIL PROTECTED]> wrote:
> If you somehow came to the conclusion that I was inferring
> that for all cipher the security can not be increased than I
> would say that your conclusion is wrong as we have a rather
> prominent example that is believed to be in that realm, the
> example being triple-DES.
> Joe
3DES is an example of a single core algorithm involved, not different
algorithms. The range of algorithms that is truely available is far more
varied than the cook-book class of wantabe cryptographers can envision.
Those that are learned enough to know this is true should not be cowed
into narrow or biased thinking simply to appease or try to impress anyone.
Evidently some of Ritter's comments are so valuable that he is censored
from plain distribution of his posts on these matters to all quadrants.
It is not cute to treat him this way; it is wrong to do so, to him or
anyone else.
--
A big-endian and a little-endian have been spotted sitting at a
campfire nibling on bytes and pointing at each other as they
argued about who got hit with the most errors.
------------------------------
Date: Sat, 05 Feb 2000 15:44:33 -0500
From: "Trevor Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: Jaws Technologies' L5 Data Encryption Algorithm?
Keith A Monahan wrote:
> Question: Whenever someone submits, let's say, an encryption algorithm
> for a patent, they have to submit the idea and methodology, etc. Are
> they required to submit the implementation of that idea? (ie jaws source)
They are not require to submit source code. In fact they aren't required to submit
anything because it's a voluntary process ;-)
However, to get a patent issued, one of the key hurdles is to show a "reduction to
practice", which means you have to show a reasonably competent practitioner of the
domain of the invention how to put the idea to work. Hand waving does not cut it.
The thing that distinguishes an invention from a Great Idea(tm) is this factor.
Source code is a crude way to show that you have achieved an RTP. Design docs that
tell a programmer how to produce an equivalent program addresses the RTP question
more completely. Then the source code is simply an example of the class of
invention the design docs describe. Consider that you could submit obfuscated
source claiming that it worked, but you would not have achieved RTP because no
reasonably competent practitioner would be able to use your invention.
Also, while patents and trade secrets are incompatible, I believe that patents and
copyright are compatible. I.e., you can patent an invention disclosing some source
in support of the claims, but you do not lose copyright over the source code. Like
a book it is not an idea (your invention), it is the expression of an idea. So the
invention isn't address by the copyright, but the expression is. The expression
isn't addressed by the patent, but the invention is.
I speculate wildly that one might actually find a niche in which a "design" patent
(which protects esthetic arrangements), a "utility" patent (which protects
inventions) and a copyright might overlap: the source code to a pretty printer.
Clearly the source code is covered by copyright. Indirectly the program describes
an esthetic arrangement of the source code it handles. And since a program is a
machine for achieving certain ends, it qualifies for a utility patent.
>
> Keith
>
> Trevor Jackson, III ([EMAIL PROTECTED]) wrote:
> : Keith A Monahan wrote:
>
> : > And my guess is they probably won't even AFTER the patent.
>
> : They have no choice. The purpose of the patent system is to disseminate
> : inventions widely, so that any proficient practitioner can employ the
> : invention. In exchange the patent holder gets a limited monopoly.
>
> : But no matter what, trade secret protection ceases as soon as a patent issues.
>
> : > Although their
> : > web page says, "Experts tell us it would be secure even if someone found
> : > out our method", I suspect that they wouldn't want to risk someone
> : > finding out their algorithm is insecure. And although their page
> : > leads you to believe they trust their methods -- I doubt they trust them
> : > enough to let the cryptographic community review it. And see, what they
> : > don't understand is that with a GOOD solid secure cipher they have
> : > nothing to fear.
> : >
> : > Keith
> : >
> : > Trevor Jackson, III ([EMAIL PROTECTED]) wrote:
> : > : Paul Koning wrote:
> : >
> : > : > John Savard wrote:
> : > : > > ... the fact that they've applied for a patent
> : > : > > means that eventually they will be able to disclose their algorithm
> : > : >
> : > : > No; if they have applied for a patent they can disclose the
> : > : > algorithm *now*.
> : >
> : > : They can, but the need not. If the patent application is rejected they
> : > : may want to preserve the information.
------------------------------
From: [EMAIL PROTECTED] (Bill Unruh)
Subject: Re: Court cases on DVD hacking is a problem for all of us
Date: 5 Feb 2000 20:39:39 GMT
In <[EMAIL PROTECTED]> [EMAIL PROTECTED]
(Highdesertman) writes:
>When encryption is used to protect copyrighted material, that
>encryption itself, if not already protected under the law, *should* be
>protected under the law. I am not a lawyer, and so, I will not argue
Nuts. Copyright is an agreement between society and the individual that
in exchange for granting a monopoly, the individual will make the work
available. To hide it and grant a monopoly is a stupid action on the
part of society. What in the world does it gain? Or are you a person who
believes that the Soviet system of state granted monopolies was a good
thing for society?
------------------------------
Date: Sat, 05 Feb 2000 15:52:56 -0500
From: "Trevor Jackson, III" <[EMAIL PROTECTED]>
Crossposted-To: sci.physics
Subject: Re: Clock drift (was Intel 810 chipset Random Number Generator)
Guy Macon wrote:
> ANYBODY HERE WANT TO HEAR THE JOKE ABOUT THE
> DRUNK DRIVING THE WRONG WAY ON THE FREEWAY??
No.
There are too many submitters to this forum who would think better drunk.
Want to hear about the legislature that takes two votes to pass a law? One
vote has to be taken with every representative sober. The other has to be
taken with every legislator sloshed. If the bill passes these stringent
tests it's _probably_ a good law. ;-)
------------------------------
From: [EMAIL PROTECTED] (Bill Unruh)
Subject: Re: english word list
Date: 5 Feb 2000 20:49:07 GMT
>)>If someone would be so kind as to post a link or two of where I can find
>)>LARGE english language word lists, it would be appreciated.
ftp.ox.ac.uk/pub/wordlists
has huge lists of words in many languages including English.
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: english version of the cipherchallenge
Date: Sat, 05 Feb 2000 21:20:42 GMT
In article <[EMAIL PROTECTED]>,
Lionux <[EMAIL PROTECTED]> wrote:
> hi,
> I have purchased the book from Simon Singh .But
being french ,I have the
> french version of the book and so of the
cipherchallenge .
> Do some of you have or know where I could find
the english version
> (without buying the book in english ) of the
cipherchallenge ?
> Thank you for your answer.
Lionux,
If you go to the site www.4thestate.co.uk you
will see a link for information on the challenge
It reads " Pour toute information sur le livre
de
Simon Singh en francais,
contactez les Editions JC Lattes,
17 rue Jacob 75006 Paris, France.
Tel: 33 (0) 1 44 41 74 00.
Fax: 33 (0) 1 43 25 30 47.
E Mail: [EMAIL PROTECTED]
But can someone help me. The site above has
information about the UK contest not the North
American on. Is there a separate contest. I
hope so. For the following reasons
1. The contest rules state that the contest is
only open to residents of the US and Canada.
2. The UK contest was well underway (Sept)
before the book was even published in North
America
Help
>
>
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: "Andersen" <[EMAIL PROTECTED]>
Subject: Polyalphabetic en/de-cryption program
Date: Sat, 5 Feb 2000 22:48:16 +0100
Does anyone know a pc program which can encrypt and decrypt plain text by
the polyalphabetic method as I need to create some exaples using that
method.
/sa
------------------------------
From: smb <[EMAIL PROTECTED]>
Subject: This is a test.
Date: Sat, 05 Feb 2000 23:24:07 GMT
This is just a test....
Cool!
Steve
------------------------------
From: [EMAIL PROTECTED] (David Wagner)
Subject: Re: NIST, AES at RSA conference
Date: 5 Feb 2000 15:53:24 -0800
In article <[EMAIL PROTECTED]>,
John Savard <[EMAIL PROTECTED]> wrote:
> I don't think he meant to say that it was proven strictly stronger,
> but simply that from a practical point of view it is very likely to be
> so (particularly when one uses three layers, to take into account the
> meet-in-the-middle attack) with reasonable choices of ciphers.
That may be so, but he did use the word "provably". The Ritter quote:
``[...] multiple ciphering is provably strong*er* [...]''
Maybe "provably" was a typo for "probably"? That would be understandable.
------------------------------
From: [EMAIL PROTECTED]
Subject: Re: How to Annoy the NSA
Date: Sat, 05 Feb 2000 23:52:52 GMT
In article <
87gbap$kdk$[EMAIL PROTECTED]>,
David A Molnar <[EMAIL PROTECTED]>
wrote:
> Douglas A. Gwyn <[EMAIL PROTECTED]> wrote:
> > David A Molnar wrote:
> >> Joseph Ashwood <[EMAIL PROTECTED]> wrote:
> >> > on the subject, at
> > http://www.sincity.com/penn-n-teller/excite/weird.html
>
>
> > In fact, sci.crypt doesn't come close to representing the state
> > of the art in cryptology, so Ashwood's "general assumption" is
> > quite dubious. It would be safe, however, to assume that some
> > NSA staff do read the technical papers published for EuroCrypt
> > and other such reputable forums for open cryptologic research.
>
With our ~10 billion dollar budget we are able
to keep track of any relevant technical
advancements. Critical systems, like our on-
going experimental development of quantum
encryption (e.g. for the Pentagon) may not be
impacted much by the content of open
cryptologic forums.
> I hope they do. Eventually I'll make enough money to pay taxes.
> When I do, I wouldn't want any wasteful duplication of work... :-)
>
Some redundancy and waste are unavoidable.
Occasionally, we need to confirm something
independently. In regards to quantum
computing, we are interested in the new
realization of Grover's search algorithm using
a single atom as a quantum processor (Science
Magazine vol.287, pages 441 & 463). Unlike
NMR, etc. this approach has the potential to be
scaled up to databases of useful sizes.
The straight poo from the NSA- respect our
awwthoitay ! ! !
>
>
Sent via Deja.com http://www.deja.com/
Before you buy.
------------------------------
From: "Joseph Ashwood" <[EMAIL PROTECTED]>
Subject: Re: NIST, AES at RSA conference
Date: Sat, 5 Feb 2000 17:08:31 -0000
> 3DES is an example of a single core algorithm involved,
not different
> algorithms.
It is also an example of successful multi-encipherment,
which is what I used it for.
> The range of algorithms that is truely available is far
more
> varied than the cook-book class of wantabe cryptographers
can envision.
> Those that are learned enough to know this is true should
not be cowed
> into narrow or biased thinking simply to appease or try to
impress anyone.
I never implied such, the only point I made was that some
ideas are ineffective.
> Evidently some of Ritter's comments are so valuable that
he is censored
> from plain distribution of his posts on these matters to
all quadrants.
> It is not cute to treat him this way; it is wrong to do
so, to him or
> anyone else.
If I ever attempt to be "cute" I won't do it on this NG, my
statements were specifically to establish a direct
contradiction to a statement that may or may not have been a
misinterpretation of Ritter's comments. In addition I see no
reason to take any person's word as gospel, I insist on
taking the time to consider if there are any simple
contradictions, and often the time to see if there is a more
complex contradiction. In this case the contradiction was
easy and simple to understand. If you are going to take
someone's word as gospel without giving consideration to the
obvious and complete contradictions that are presented, I
would appreciate it if you would take those comments to
private e-mail, I will no longer respond to this thread on
the newsgroup.
Joe
------------------------------
From: [EMAIL PROTECTED] (Bill Unruh)
Subject: Re: english version of the cipherchallenge
Date: 6 Feb 2000 01:20:54 GMT
In <87i476$ili$[EMAIL PROTECTED]> [EMAIL PROTECTED] writes:
>But can someone help me. The site above has
>information about the UK contest not the North
>American on. Is there a separate contest. I
>hope so. For the following reasons
>1. The contest rules state that the contest is
>only open to residents of the US and Canada.
Just one contest AFAIK. I think those rules are there for some legal reasons
for the N AM publisher of the book. Also there is a difference in the
prize- dollars rather than pounds. And the fact that UK people have had
longer is just the way it goes. Some people also did not purchase the
book until late (I got mine for Christmas, at lest two months after the
N Am publication)
------------------------------
From: [EMAIL PROTECTED] (Maarten)
Crossposted-To: alt.security.pgp,comp.security.unix
Subject: Re: How to password protect files on distribution CD
Date: Sun, 06 Feb 2000 00:59:11 GMT
[Posted and, by mistake, also mailed. Please excuse me.]
Eric Lee Green <[EMAIL PROTECTED]> wrote:
>Roger Gammans wrote:
>> In article <87dhke$6ok$[EMAIL PROTECTED]>, Vernon Schryver wrote:
>> >In article <[EMAIL PROTECTED]>,
>> >Eric Lee Green <[EMAIL PROTECTED]> wrote:
>> >> ...
>> >>Regarding leaving old cards in machine, I don't know of a reliable way to get
>> >>the MAC address of a second card under Linux or SCO Unix. For that matter,
>> >>there's "magic" involved in getting the MAC address of the FIRST card.
Magic you call that ? I call it ifconfig. ;)
>[eric@ehome eric]$ ifconfig -a | grep HWaddr
>cipcb0 Link encap:IPIP Tunnel HWaddr
>eth0 Link encap:Ethernet HWaddr 00:40:33:D2:00:03
>eth1 Link encap:Ethernet HWaddr 00:00:C0:AB:D1:E8
>
>Do note that the low-level sysctl calls being made by 'ifconfig' are dependent
>upon the kernel version being used. That's why the 'nettools' package has to
>be updated for each release of the Linux kernel. For that matter, Linus has
>mentioned doing away with 'sysctl' altogether and relying upon '/proc' to
>report all such data. And the 'nettools' package itself contains no guarantee
>that it will not at some point change the order in which data is reported.
>net1: flags=4043<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
> inet 192.168.0.3 netmask ffffff00 broadcast 192.168.0.255
> perf. params: recv size: 24576; send size: 24576; full-size frames: 1
> ether 00:40:c7:79:1b:c9
>Looks like we have to look for 'ether' here, sigh.
>
>Are you starting to get the drift of where I'm going when I say there's no
>STANDARD way of getting a hardware MAC address on Unix?
Aw come on... How hard can it be to grep the output of all known
ifconfig(and their possibly differently-named counterparts)
for a string of 6 double hex figures separated by colons ?
You can add in all flavors of grepping for either ether|hard|hw|addr
etc. if you must, but finding the MAC address can quite easily be done
in a sufficiently generic way. IMHO.
How big are the chances of you indeed finding such a string NOT being
a MAC address ? Really quite distant I think...
>Now granted, the HP/UX box has a hardware ID that is readable from "C". If I
>dug around I could undoubtedly find a sysctl call that'll similarly return the
>MAC addresses of its interfaces (it has two, a 10mbit AUI connector and a
>100BaseT connector). But this all varies widely from Unix to Unix, and even on
>Linux it's not guaranteed to continue working next year (when Linus might
>decide to change the sysctl structs for networks yet again, since only system
>tools are supposed to use sysctl).
Yeah, but what prevents you from using 'ifconfig', whose relevant
output does not change from kernel- version to version.
Maarten
--
"Wow, virtual memory is great! I'm going to make a giant ramdisk!"
------------------------------
From: "r.e.s." <[EMAIL PROTECTED]>
Subject: Random-Width Transposition Tables?
Date: Sat, 5 Feb 2000 18:32:42 -0800
Some ciphers using columnar transposition randomize the width of the
transposition table over some range [lo, hi] -- even though, compared
to fixing the width at the hi value, this results in less entropy wrt
column-order, and so tends to make a key-search easier. (E.g., VIC's
double transposition requires table-widths that are unequal but
otherwise random over a span of ten possible values.)
I can only speculate that a rationale to justify such a sacrifice
of entropy must involve hardening wrt to non-brute-force attacks.
Is that correct? Is there any "accepted wisdom" about when, whether,
and/or how much to randomize transposition table-widths?
--
r.e.s.
[EMAIL PROTECTED]
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
