Perry: Would you so kind as to fwd this message and not the other one? This is better ... and shorter ;-) Thanks, Ed ----------------------- List: [ Complete text at http://www.mcg.org.br/unicity.txt ] This exposition initially revisits the concept of "unicity" and shows that key-length is not the most important parameter to evaluate the security of cryptographic systems, discussing possible weaknessess in current systems and alternatives as well. Applying the concepts developed, the paper shows that DES English messages can be brute-force attacked over a plaintext space of only 3 characters -- instead of the currently assumed limit of 20 characters. It also shows that the low-end limit of security/key-bit is occupied by DES. This result immediately impacts the assumed security of SSL, S/MIME and other protocols that use DES. It further shows that re-keying is not of very much use under DES, even if done out-of-band, since one would have to re-key after every two characters of text. The exposition also advances other topics to motivate discussion of higher-security cipher systems, even when short key-lengths need to be used. Specially, concrete examples show the usefulness of "open trust" (i.e., open-keys) to increase security -- in addition to the currently exclusive use of "closed trust" (i.e., secret-keys). Since open-keys are public, the concept may afford a way to increase security even within imposed secret-key key-length limitations. By allowing the secure use of smaller secret-keys, the open-key concept can have other applications, such as in smart-cards, digital signatures, authentication, non-repudiation, etc. Comments are welcome. Cheers, Ed Gerck ______________________________________________________________________ Dr.rer.nat. E. Gerck [EMAIL PROTECTED] http://novaware.com.br --- Meta-Certificate Group member -- http://www.mcg.org.br ---
