Re: [cryptography] preventing protocol failings

2011-07-05 Thread Jon Callas
On Jul 4, 2011, at 10:10 PM, coderman wrote: H3 should be Gospel: There is Only One Mode and it is Secure anything else is a failure waiting to happen… Yeah, sure. I agree completely. How could any sane person not agree? We could rephrase this as, The Nineties Called, and They Want Their

Re: [cryptography] preventing protocol failings

2011-07-05 Thread Peter Gutmann
coderman coder...@gmail.com writes: H3 should be Gospel: There is Only One Mode and it is Secure Also known as Grigg's Law. The corollary, for protocols where there *are* options, is There is one one cipher suite and that is Suite #1. Peter. ___

Re: [cryptography] preventing protocol failings

2011-07-05 Thread coderman
On Mon, Jul 4, 2011 at 11:31 PM, Peter Gutmann pgut...@cs.auckland.ac.nz wrote: ... The corollary, for protocols where there *are* options, is There is one one cipher suite and that is Suite #1. hey, removing all other options can be an option. uh oh, i just contradicted myself...

[cryptography] Bitcoin observation

2011-07-05 Thread Jon Callas
I was sitting around the other weekend with some friends and we were talking about Bitcoin, and gossiping furiously about it. While we were doing so, an interesting property came up. Did you know that if a Bitcoin is destroyed, then the value of all the other Bitcoins goes up slightly? That's

Re: [cryptography] preventing protocol failings

2011-07-05 Thread coderman
On Mon, Jul 4, 2011 at 11:11 PM, Jon Callas j...@callas.org wrote: ... Yeah, sure. I agree completely. no you don't ;) How can I use this principle as a touchstone to let me know the right thing to do. I suppose we could consider it a rule of thumb instead, but that flies in the face of

Re: [cryptography] Bitcoin observation

2011-07-05 Thread coderman
On Mon, Jul 4, 2011 at 11:44 PM, Jon Callas j...@callas.org wrote: ... Did you know that if a Bitcoin is destroyed, then the value of all the other Bitcoins goes up slightly? That's incredible. It's amazing and leads to some emergent properties. this is not completely correct. it is only

Re: [cryptography] Bitcoin observation

2011-07-05 Thread Jon Callas
On Jul 5, 2011, at 12:07 AM, coderman wrote: On Mon, Jul 4, 2011 at 11:44 PM, Jon Callas j...@callas.org wrote: ... Did you know that if a Bitcoin is destroyed, then the value of all the other Bitcoins goes up slightly? That's incredible. It's amazing and leads to some emergent

Re: [cryptography] preventing protocol failings

2011-07-05 Thread Jon Callas
On Jul 4, 2011, at 11:35 PM, coderman wrote: On Mon, Jul 4, 2011 at 11:11 PM, Jon Callas j...@callas.org wrote: ... Yeah, sure. I agree completely. no you don't ;) Actually I do. I also believe in truth and justice and beauty, too. And simplicity. I just value actionable, as well.

Re: [cryptography] Bitcoin observation

2011-07-05 Thread Ian G
On 5/07/11 4:44 PM, Jon Callas wrote: Did you know that if a Bitcoin is destroyed, then the value of all the other Bitcoins goes up slightly? That's incredible. It's amazing and leads to some emergent properties. This assumes fixed value. As there is no definition of the value in BitCoin,

Re: [cryptography] Bitcoin observation

2011-07-05 Thread Adam Back
I dont think you can prove you have destroyed a bitcoin, neither your own bitcoin, nor someone else's. To destroy it you would have to prove you deleted the coin private key, and you could always have an offline backup. You could uncreate a coin by creating a chain removing it from existance,

Re: [cryptography] Bitcoin observation

2011-07-05 Thread dan
Jon Callas writes: -+ | Did you know that if a Bitcoin is destroyed, then the value of all | the other Bitcoins goes up slightly? That's incredible. It's amazing | and leads to some emergent properties. | I suspect that this is true of gold as well -- send it into space or

[cryptography] Minimally Sufficient Cryptosystem

2011-07-05 Thread Scott Guthery
Adi Shamir gave a talk at MIT last week at which I think he said that the following cryptosystem was minimally sufficient: XOR Key / Permutation / XOR Key He seemed to me to imply that (informally speaking) any additional complexity would be more likely to provide attack opportunities than

Re: [cryptography] preventing protocol failings

2011-07-05 Thread Peter Gutmann
Nico Williams n...@cryptonector.com writes: Why even have a tag?? The ASN.1 Packed Encoding Rules (think ONC XDR with 1- byte alignment instead of 4-byte alignment) doesn't use tags at all. Which makes them impossible to statically check, and leads to hellishly complex decoders. In

Re: [cryptography] Minimally Sufficient Cryptosystem

2011-07-05 Thread Jonathan Katz
On Tue, 5 Jul 2011, Scott Guthery wrote: Adi Shamir gave a talk at MIT last week at which I think he said that the following cryptosystem was minimally sufficient: XOR Key / Permutation / XOR Key He seemed to me to imply that (informally speaking) any additional complexity would be more

Re: [cryptography] Minimally Sufficient Cryptosystem

2011-07-05 Thread Alfonso De Gregorio
On Tue, Jul 5, 2011 at 3:21 PM, Jean-Philippe Aumasson jeanphilippe.aumas...@gmail.com wrote: See the Asiacrypt 2010 rump session talk An Optimal Attack On Cryptosystems With Pre/Post Whitening Keys by Orr Dunkelman and Adi Shamir:

Re: [cryptography] Minimally Sufficient Cryptosystem

2011-07-05 Thread Tom Ritter
Perhaps anybody else that was there or is familiar with Shamir's work along this line might comment. I was in Boston last Friday as well - Jean-Philippe is correct, the second half of the talk was on the Even-Mansour system, and Adi talked about his SLIDEX attack. He may have expanded on it a

Re: [cryptography] preventing protocol failings

2011-07-05 Thread Steven Bellovin
there may be a pragmatic need for options dealing with existing systems or business requirements, however i have yet to hear a convincing argument for why options are necessary in any new system where you're able to apply lessons learned from past mistakes. You said it yourself: different

Re: [cryptography] preventing protocol failings

2011-07-05 Thread Arshad Noor
On 07/05/2011 09:09 AM, Steven Bellovin wrote: More importantly (and to pick a less extreme scenario), security isn't an absolute, it's a matter of economics. If the resource you're protecting isn't worth much, why should you spend a lot? And, one does not need to guess at how much a lot is;

Re: [cryptography] Minimally Sufficient Cryptosystem

2011-07-05 Thread Alexander Klimov
On Tue, 5 Jul 2011, Scott Guthery wrote: the following cryptosystem was minimally sufficient: XOR Key / Permutation / XOR Key A Construction of a Cipher From a Single Pseudorandom Permutation http://citeseer.ist.psu.edu/viewdoc/summary?doi=10.1.1.53.9789 One can see it as a hint that building

Re: [cryptography] Bitcoin observation

2011-07-05 Thread Steven Bellovin
On Jul 5, 2011, at 2:44 57AM, Jon Callas wrote: I was sitting around the other weekend with some friends and we were talking about Bitcoin, and gossiping furiously about it. While we were doing so, an interesting property came up. Did you know that if a Bitcoin is destroyed, then the

Re: [cryptography] preventing protocol failings

2011-07-05 Thread Ian G
On 5/07/11 3:59 PM, Jon Callas wrote: There are plenty of people who agree with you that options are bad. I'm not one of them. Yeah, yeah, sure, it's always easy to make too many options. But just because you can have too many options that doesn't mean that zero is the right answer. That's

Re: [cryptography] Bitcoin observation

2011-07-05 Thread Taral
On Tue, Jul 5, 2011 at 3:53 AM, Adam Back a...@cypherspace.org wrote: I dont think you can prove you have destroyed a bitcoin, neither your own bitcoin, nor someone else's.  To destroy it you would have to prove you deleted the coin private key, and you could always have an offline backup.

Re: [cryptography] Bitcoin observation

2011-07-05 Thread Marsh Ray
On 07/05/2011 08:07 PM, Taral wrote: On Tue, Jul 5, 2011 at 3:53 AM, Adam Backa...@cypherspace.org wrote: I dont think you can prove you have destroyed a bitcoin, neither your own bitcoin, nor someone else's. To destroy it you would have to prove you deleted the coin private key, and you

Re: [cryptography] Bitcoin observation

2011-07-05 Thread Taral
On Tue, Jul 5, 2011 at 7:16 PM, Marsh Ray ma...@extendedsubset.com wrote: So this suggests the attacker who pwned Mt. Gox was probably doing it for the lulz as they say. (Or maybe they didn't know about this property). Next time they might just take all the bitcoins held in escrow by the

Re: [cryptography] Bitcoin observation

2011-07-05 Thread John Levine
Did you know that if a Bitcoin is destroyed, then the value of all the other Bitcoins goes up slightly? That's incredible. It's amazing and leads to some emergent properties Let's imagine that there was an artist who we'll call Aldi. He made a lot of signed prints, which are worth whatever

Re: [cryptography] preventing protocol failings

2011-07-05 Thread Peter Gutmann
Nico Williams n...@cryptonector.com writes: In other words, in ASN.1 as it's used you have to know the schema and message type in order to do a good job of parsing the message, No you don't. I give as a counterexample dumpasn1, which knows nothing about message types or schemas, but parses

Re: [cryptography] Bitcoin observation

2011-07-05 Thread Alfonso De Gregorio
On Tue, Jul 5, 2011 at 9:22 AM, Jon Callas j...@callas.org wrote: Good points. But nonetheless, it's a really, really cool property of the system that you can gain by destroying bitcoins. I mean heck -- let's create another sub-constant, H_s which is the constant that shows when it better to