Most cryptographers will admit that simply because we have tested a cipher and found it to be strong does not mean our opponents will find it to be similarly strong. On the other hand, some cryptographers are willing to say that a cipher is "unlikely" to be found weak. Unfortunately, such statements simply have no basis in science.
Other cryptographers are happy to say that any exposure of data is less likely to happen from a respected cipher than from the rest of the cipher system. But, again, unless flaws are actually known in the cipher system (in which case they should be fixed), there is no scientific basis for such an estimate.
The reality of our situation is that we do not and can not know how strong our ciphers are when they encounter our opponents. The opponents operate in secret and do not announce their successes. They have all the information in the "open literature," plus whatever else they have developed over time. They may be reading our mail, and just not talking about it.
Our problem, then, is that the cipher we use -- and which everyone else also uses -- may be weak and may be exposing our data and we would not know. Obviously, that will continue until we change our cipher. Obviously, our cipher systems should make cipher change easy and common. But, obviously, most do not.
Since we have to change to something, we would seem to have to use ciphers which are less trusted. Fortunately, we can avoid that. We certainly do have to use new ciphers, but we do not have to rely upon them exclusively, because we can encipher using an old "trusted" cipher as well as a couple of new ones. So we can keep whatever strength the old cipher has, and also change the other ciphers in the mix frequently. We can have both trust and strength simultaneously.
This is Shannon's "algebra of secrecy systems" in practice: multiciphering and cipher selection combined. Strangely, cryptography continues to resist actual implementation. I suppose that is because cryptographers think such a system is "unnecessary." But that is just another way to talk about weakness probability estimates which have no basis in science.
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 16:41:57 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <390085B9.D5369DB0@dasoft.org> References: <390081B3.B998F5E0@acm.org> <39003AD2.9CE98F24@dasoft.org> Newsgroups: sci.crypt Lines: 25 Mike Kent wrote: > > Tom St Denis wrote: > > > UBCHI2 wrote: > ... > > > Intractable math problem are only in the eye of the beholder. How many of you > > > would have thought that the enigma could be broken? > > > > This is amazingly false. > > Hmmm, it's _very probably_ amazingly false. I would like to think all the math-wizards know what they are doing. Ciphers along the same idea as DES (i.e feistel) have been around for a while. Of course it's entirely possible that all AES ciphers and pre-aes ciphers get broken tommorow. However, that is as likely as monkeys learning speech and taking over the world while we are asleep. Both could happend, but neither will. Of course having a monkey as a master isn't a big change for alot of people... hehehe
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 16:57:30 GMT From: ritter@io.com (Terry Ritter) Message-ID: <39008864.6910045@news.io.com> References: <390085B9.D5369DB0@dasoft.org> Newsgroups: sci.crypt Lines: 47 On Fri, 21 Apr 2000 16:41:57 GMT, in <390085B9.D5369DB0@dasoft.org>, in sci.crypt Tom St Denis <tom@dasoft.org> wrote: >Mike Kent wrote: >> >> Tom St Denis wrote: >> >> > UBCHI2 wrote: >> ... >> > > Intractable math problem are only in the eye of the beholder. How many of you >> > > would have thought that the enigma could be broken? >> > >> > This is amazingly false. >> >> Hmmm, it's _very probably_ amazingly false. > >I would like to think all the math-wizards know what they are doing. >Ciphers along the same idea as DES (i.e feistel) have been around for a >while. > >Of course it's entirely possible that all AES ciphers and pre-aes >ciphers get broken tommorow. However, that is as likely as monkeys >learning speech and taking over the world while we are asleep. True, the original claims were over the top, but this is way beyond what we know in the other direction. We do not know the strength of these ciphers. The designers and reviewers do not know the strength of these ciphers. None of us *can* know strength with respect to opponents we do not know and whose knowledge and resources we also do not know. There exists no basis for asserting that breaking these ciphers is "unlikely." We have no testable probability distribution for the breaking of ciphers. If the only thing we have to go on is the limited published experience, we might well say that every algorithmic cipher is likely to be broken eventually. And that is precisely the opposite of your unproven assertion that breaking AES is unlikely. >Both could happend, but neither will. Of course having a monkey as a >master isn't a big change for alot of people... hehehe --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 17:12:28 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <39008CE1.76964BF0@dasoft.org> References: <39008864.6910045@news.io.com> Newsgroups: sci.crypt Lines: 52 Terry Ritter wrote: > > On Fri, 21 Apr 2000 16:41:57 GMT, in <390085B9.D5369DB0@dasoft.org>, > in sci.crypt Tom St Denis <tom@dasoft.org> wrote: > > >Mike Kent wrote: > >> > >> Tom St Denis wrote: > >> > >> > UBCHI2 wrote: > >> ... > >> > > Intractable math problem are only in the eye of the beholder. How many of you > >> > > would have thought that the enigma could be broken? > >> > > >> > This is amazingly false. > >> > >> Hmmm, it's _very probably_ amazingly false. > > > >I would like to think all the math-wizards know what they are doing. > >Ciphers along the same idea as DES (i.e feistel) have been around for a > >while. > > > >Of course it's entirely possible that all AES ciphers and pre-aes > >ciphers get broken tommorow. However, that is as likely as monkeys > >learning speech and taking over the world while we are asleep. > > True, the original claims were over the top, but this is way beyond > what we know in the other direction. We do not know the strength of > these ciphers. The designers and reviewers do not know the strength > of these ciphers. None of us *can* know strength with respect to > opponents we do not know and whose knowledge and resources we also do > not know. > > There exists no basis for asserting that breaking these ciphers is > "unlikely." We have no testable probability distribution for the > breaking of ciphers. If the only thing we have to go on is the > limited published experience, we might well say that every algorithmic > cipher is likely to be broken eventually. And that is precisely the > opposite of your unproven assertion that breaking AES is unlikely. True, but we know (or should I say 'they know') alot about various metrics to attack ciphers. So we can begin. We can tell for example that a cipher is weak because we can break it. Given all the talent in the world if no one comes up with a metric to break a new cipher, then for that time being it's secure. Of course of all the ciphers used since the 70's none of them have yet been broken. So that's a good track record so far.... Tom
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 18:06:17 GMT From: "Douglas A. Gwyn" <gwyn@arl.mil> Message-ID: <39009899.118477B5@arl.mil> References: <39008CE1.76964BF0@dasoft.org> Newsgroups: sci.crypt Lines: 5 Tom St Denis wrote: > Of course of all the ciphers used since the 70's none of them have yet > been broken. What makes you think that?
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 20:24:37 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <3900B9EA.1C5ECCBD@dasoft.org> References: <39009899.118477B5@arl.mil> Newsgroups: sci.crypt Lines: 19 "Douglas A. Gwyn" wrote: > > Tom St Denis wrote: > > Of course of all the ciphers used since the 70's none of them have yet > > been broken. > > What makes you think that? Praticallity. Even if the spooks could break say 3DES in three easy steps, and nobody else knew, would it matter? Most likely not. It wouldn't be great, but better then the alternative. However I sincerely doubt the 'spooks' could break any respectable modern cipher in a realistic amount of time, most likely they would attackt he implementation or system not the cipher. Tom
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 16:09:10 GMT From: jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) Message-ID: <3901cd7e.2340714@news.ecn.ab.ca> References: <3900B9EA.1C5ECCBD@dasoft.org> Newsgroups: sci.crypt Lines: 35 On Fri, 21 Apr 2000 20:24:37 GMT, Tom St Denis <tom@dasoft.org> wrote, in part: >"Douglas A. Gwyn" wrote: >> Tom St Denis wrote: >> > Of course of all the ciphers used since the 70's none of them have yet >> > been broken. >> What makes you think that? >Praticallity. Even if the spooks could break say 3DES in three easy >steps, and nobody else knew, would it matter? Most likely not. It >wouldn't be great, but better then the alternative. It wouldn't for most applications. However, if your data must remain secret for 100 years, word might leak from the spooks in that time. >However I sincerely doubt the 'spooks' could break any respectable >modern cipher in a realistic amount of time, most likely they would >attack the implementation or system not the cipher. That is basically true, and they're mostly being kept in business by countries that can't yet use respectable modern ciphers for some purposes, it _appears_. But as to the earlier controversial statement: If you mean, starting in 1980, and you don't really mean any cipher that anyone has _used_ since then, but simply those ciphers that were generally recognized as secure in that time, you would still have a problem, since single-DES qualifies under that description. During the 1970s, there was LUCIFER, which fell to differential cryptanalysis. And during the 1980s and 1990s, lots of people still used snake oil.
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 18:22:47 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <3901EED1.621E9F6A@dasoft.org> References: <3901cd7e.2340714@news.ecn.ab.ca> Newsgroups: sci.crypt Lines: 49 John Savard wrote: > > On Fri, 21 Apr 2000 20:24:37 GMT, Tom St Denis <tom@dasoft.org> wrote, > in part: > >"Douglas A. Gwyn" wrote: > >> Tom St Denis wrote: > > >> > Of course of all the ciphers used since the 70's none of them have yet > >> > been broken. > > >> What makes you think that? > > >Praticallity. Even if the spooks could break say 3DES in three easy > >steps, and nobody else knew, would it matter? Most likely not. It > >wouldn't be great, but better then the alternative. > > It wouldn't for most applications. However, if your data must remain > secret for 100 years, word might leak from the spooks in that time. > > >However I sincerely doubt the 'spooks' could break any respectable > >modern cipher in a realistic amount of time, most likely they would > >attack the implementation or system not the cipher. > > That is basically true, and they're mostly being kept in business by > countries that can't yet use respectable modern ciphers for some > purposes, it _appears_. > > But as to the earlier controversial statement: > > If you mean, starting in 1980, and you don't really mean any cipher > that anyone has _used_ since then, but simply those ciphers that were > generally recognized as secure in that time, you would still have a > problem, since single-DES qualifies under that description. DES technically was never practically broken. The short key size is just a symptom of poor design judgement. In other words it does provide 2^56 security (thereabouts) as claimed. > During the 1970s, there was LUCIFER, which fell to differential > cryptanalysis. And during the 1980s and 1990s, lots of people still > used snake oil. What standard is LUCIFER part of? So what? At the same time FEAL was proposed, and broken, so was LOKI89 and a bunch of other ciphers. DES was part of a standard. Tom
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 12:48:11 -0700 From: "Joseph Ashwood" <ashwood@email.msn.com> Message-ID: <#btnDt8q$GA.303@cpmsnbbsa04> References: <39008CE1.76964BF0@dasoft.org> Newsgroups: sci.crypt Lines: 16 > Of course of all the ciphers used since the 70's none of them have yet > been broken. So that's a good track record so far.... That's where I think you're quite wrong. Just looking at the opening round of AES several of the proposals were quite effectively broken. Looking on this ng we have seen several proposed ciphers, and for quite some time, not a single one hasn't had massive amounts of progress made against it. The finalists for AES are only 5 of thousands that have been thought of in the same time period. While I agree that the breaking of an AES finalist in the next few years is unlikely, unbreakability against an infinite future is at best laughable. Joe
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 20:06:24 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <3900B5A5.A9805114@dasoft.org> References: <#btnDt8q$GA.303@cpmsnbbsa04> Newsgroups: sci.crypt Lines: 26 Joseph Ashwood wrote: > > > Of course of all the ciphers used since the 70's none of > them have yet > > been broken. So that's a good track record so far.... > That's where I think you're quite wrong. Just looking at the > opening round of AES several of the proposals were quite > effectively broken. Looking on this ng we have seen several > proposed ciphers, and for quite some time, not a single one > hasn't had massive amounts of progress made against it. The > finalists for AES are only 5 of thousands that have been > thought of in the same time period. While I agree that the > breaking of an AES finalist in the next few years is > unlikely, unbreakability against an infinite future is at > best laughable. > Joe I meant used. The lastest used ciphers are 3des, cast128 and idea, all of which have had considerable analysis put against. Of course anybody can make a cipher that is trivial breakable. But those that have survived all our known tests, are secure. Tom
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 13:21:49 -0700 From: "Joseph Ashwood" <ashwood@email.msn.com> Message-ID: <ekYYvD9q$GA.361@cpmsnbbsa04> References: <3900B5A5.A9805114@dasoft.org> Newsgroups: sci.crypt Lines: 12 > I meant used. The lastest used ciphers are 3des, cast128 and idea, all > of which have had considerable analysis put against. Of course anybody > can make a cipher that is trivial breakable. But those that have > survived all our known tests, are secure. And 3des, cast128 and idea are all from the last five years, although the building block for 3des has been around longer. Joe
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 20:52:14 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <3900C063.4CB794AA@dasoft.org> References: <ekYYvD9q$GA.361@cpmsnbbsa04> Newsgroups: sci.crypt Lines: 19 Joseph Ashwood wrote: > > > I meant used. The lastest used ciphers are 3des, cast128 > and idea, all > > of which have had considerable analysis put against. Of > course anybody > > can make a cipher that is trivial breakable. But those > that have > > survived all our known tests, are secure. > And 3des, cast128 and idea are all from the last five years, > although the building block for 3des has been around longer. > Joe Although the building blocks for cast have been around much longer too. See the papers by Charlise Adams from the 80's, etc.. Tom
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 17:12:43 -0400 From: Paul Koning <pkoning@lucent.com> Message-ID: <3900C44B.2F3FC7DA@lucent.com> References: <ekYYvD9q$GA.361@cpmsnbbsa04> Newsgroups: sci.crypt Lines: 22 Tom St Denis wrote: > Of course of all the ciphers used since the 70's none of them have yet > been broken. Sure they have. DES... Or did you mean "have succumbed to an attack better than exhaustive search"? Then perhaps it doesn't apply to DES, but that's not the right question to ask. Joseph Ashwood wrote: > ... > And 3des, cast128 and idea are all from the last five years, > although the building block for 3des has been around longer. Not so. Multiple DES was mentioned in IEEE Spectrum 7/1979, and for all I know may have been described earlier than that. IDEA was published in 1991, and CAST in 1993. Sounds like more than 5 years to me... paul
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 22:09:09 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <3900D26B.A25248BB@dasoft.org> References: <3900C44B.2F3FC7DA@lucent.com> Newsgroups: sci.crypt Lines: 29 Paul Koning wrote: > > Tom St Denis wrote: > > Of course of all the ciphers used since the 70's none of them have yet > > been broken. > > Sure they have. DES... > > Or did you mean "have succumbed to an attack better than > exhaustive search"? Then perhaps it doesn't apply to > DES, but that's not the right question to ask. > > Joseph Ashwood wrote: > > ... > > And 3des, cast128 and idea are all from the last five years, > > although the building block for 3des has been around longer. > > Not so. Multiple DES was mentioned in IEEE Spectrum 7/1979, > and for all I know may have been described earlier than that. > > IDEA was published in 1991, and CAST in 1993. Sounds like > more than 5 years to me... The design principles behind CAST came out well before 1993, as did for IDEA. Tom
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 03:35:38 +0100 From: David Hopwood <hopwood@zetnet.co.uk> Message-ID: <39010FFA.5C52455A@zetnet.co.uk> References: <ekYYvD9q$GA.361@cpmsnbbsa04> Newsgroups: sci.crypt Lines: 43 -----BEGIN PGP SIGNED MESSAGE----- Joseph Ashwood wrote: > Tom St Denis wrote: > > I meant used. The lastest used ciphers are 3des, cast128 > > and idea, all of which have had considerable analysis put against. > > Of course anybody can make a cipher that is trivial breakable. > > But those that have survived all our known tests, are secure. > > And 3des, cast128 and idea are all from the last five years, > although the building block for 3des has been around longer. 3DES was proposed in: R.C. Merkle, M. Hellman, "On the Security of Multiple Encryption," Communications of the ACM, vol. 24 no. 7, 1981, pp. 465-467. ^^^^ I.e. 19 years ago. (IDEA was proposed in 1992, CAST-128 in 1997.) - -- David Hopwood <hopwood@zetnet.co.uk> PGP public key: http://www.users.zetnet.co.uk/hopwood/public.asc RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5 0F 69 8C D4 FA 66 15 01 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOQEPiDkCAxeYt5gVAQGhDQf/eSrK/iDuTZWUs89HSyV5Zyo0HwUusiCw w8nRyIq7kV9zEYcpspFuKiCUh6XpLGkkBWtGQmUPI6eP/Cxq0aSFlgtoAUG2THdX IJIwbA/qkX6JiXG7CSPQI399tqAU+nmwszAtspOy3gR5sZryvFgvDbwv3qDuLFCE 13UbGdeP1XX2VzPY1A7lra2QuexgpiMeqPDfg1Fs9S4gQfvW2O7Lbd6sECPe+BX+ nEpcPY7zZZIOGCxu/8o232BAn93zDyUEoa/OplT2dx2J9Yp37RAa5TGug2I9jtcb 9nlOksJ/Ma91gnV0Eyjxe113rWkqaWb27AOMOM+dm7biK6IUAMppIA== =eZej -----END PGP SIGNATURE-----
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 21:50:34 GMT From: ritter@io.com (Terry Ritter) Message-ID: <3900cd00.1699834@news.io.com> References: <3900B5A5.A9805114@dasoft.org> Newsgroups: sci.crypt Lines: 21 On Fri, 21 Apr 2000 20:06:24 GMT, in <3900B5A5.A9805114@dasoft.org>, in sci.crypt Tom St Denis <tom@dasoft.org> wrote: >[...] >I meant used. The lastest used ciphers are 3des, cast128 and idea, all >of which have had considerable analysis put against. Of course anybody >can make a cipher that is trivial breakable. But those that have >survived all our known tests, are secure. This flaunts the edge of what we know. Surviving *our* tests does not make a cipher secure. A cipher is secure -- and protects our data -- only when it survives the secret unknown attacks by our unknown attackers. Those attackers do not announce their successes, so if they are successful, we will never know. Even if the cipher has survived all of our tests. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 21:58:30 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <3900CFEB.3B1884AA@dasoft.org> References: <3900cd00.1699834@news.io.com> Newsgroups: sci.crypt Lines: 41 Terry Ritter wrote: > > On Fri, 21 Apr 2000 20:06:24 GMT, in <3900B5A5.A9805114@dasoft.org>, > in sci.crypt Tom St Denis <tom@dasoft.org> wrote: > > >[...] > >I meant used. The lastest used ciphers are 3des, cast128 and idea, all > >of which have had considerable analysis put against. Of course anybody > >can make a cipher that is trivial breakable. But those that have > >survived all our known tests, are secure. > > This flaunts the edge of what we know. Surviving *our* tests does not > make a cipher secure. A cipher is secure -- and protects our data -- > only when it survives the secret unknown attacks by our unknown > attackers. Those attackers do not announce their successes, so if > they are successful, we will never know. Even if the cipher has > survived all of our tests. If money starts disappearing we will know for sure. It may be too late but we will know. Seriously though, it's good to be cautious, but when years of constant pressure and work cannot break an algorithm, it's most likely that it can't be done. Take factoring for example. Been worked on for 1000s of years, and we still can't factor as fast as one would want to. Like nobody will really find the factors for n = 7845464894948624085817674125006260680782223977132130103813467169531516537849\ 05071193915597920110439954227055221771064236731175096156784015401689495213130748\ 60509508765626164401372205205788363152458477780132197255553417102647530965046777\ 799344029763540728789585552629530174624630219899102518383088153375672107 before I am long since dead. So there are problems that are just plain hard. Tom
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 22:24:48 GMT From: ritter@io.com (Terry Ritter) Message-ID: <3900d457.3579114@news.io.com> References: <3900CFEB.3B1884AA@dasoft.org> Newsgroups: sci.crypt Lines: 81 On Fri, 21 Apr 2000 21:58:30 GMT, in <3900CFEB.3B1884AA@dasoft.org>, in sci.crypt Tom St Denis <tom@dasoft.org> wrote: > > >Terry Ritter wrote: >> >> On Fri, 21 Apr 2000 20:06:24 GMT, in <3900B5A5.A9805114@dasoft.org>, >> in sci.crypt Tom St Denis <tom@dasoft.org> wrote: >> >> >[...] >> >I meant used. The lastest used ciphers are 3des, cast128 and idea, all >> >of which have had considerable analysis put against. Of course anybody >> >can make a cipher that is trivial breakable. But those that have >> >survived all our known tests, are secure. >> >> This flaunts the edge of what we know. Surviving *our* tests does not >> make a cipher secure. A cipher is secure -- and protects our data -- >> only when it survives the secret unknown attacks by our unknown >> attackers. Those attackers do not announce their successes, so if >> they are successful, we will never know. Even if the cipher has >> survived all of our tests. > >If money starts disappearing we will know for sure. It may be too late >but we will know. Yes, but that isn't the general reality of secret information. Normally, there are various possible alternatives ("channels") for a secret getting out, and there may be no real way to identify which occurred. This is especially the case if the other side undertakes operations to confuse the issue. In fact, normally we do not even know that the secret in fact did get out; what we know, for example, is that a bid has been lost by an extraordinarily close amount, and that could have been by chance. (In wartime, we may lose a boat, but that happens.) We may have suspicions, yet be unable quantify them to become sufficiently convincing so that crypto users will change to another cipher. To get the cipher changed, we almost need to prove something we cannot hope to prove. It can be very, very difficult to identify a crypto leak as opposed to some other leak, or just the effects of raw chance. Generally we will not know for sure. Crypto leaks might occur fairly regularly on the common systems in use today and we might well not know that. >Seriously though, it's good to be cautious, but when years of constant >pressure and work cannot break an algorithm, it's most likely that it >can't be done. The original issue was AES, and it certainly has not been all that long for AES. For example, there is no way to know just how much effort has been contributed, or what that effort covered. The whole thing is sort of "Whatever." >Take factoring for example. Been worked on for 1000s of years, and we >still can't factor as fast as one would want to. Like nobody will >really find the factors for > >n = >7845464894948624085817674125006260680782223977132130103813467169531516537849\ >05071193915597920110439954227055221771064236731175096156784015401689495213130748\ >60509508765626164401372205205788363152458477780132197255553417102647530965046777\ >799344029763540728789585552629530174624630219899102518383088153375672107 > >before I am long since dead. So there are problems that are just plain >hard. Actually, I find factoring a good example: Looking to the past, it is my impression that various great math minds have spent time on the factoring problem, presumably because they had some intuition that they could make progress. I respect such intuition, and the fact that we still have a problem is not particularly comforting to me. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 22:31:56 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <3900D7C1.B4D8FDB7@dasoft.org> References: <3900d457.3579114@news.io.com> Newsgroups: sci.crypt Lines: 90 Terry Ritter wrote: > > On Fri, 21 Apr 2000 21:58:30 GMT, in <3900CFEB.3B1884AA@dasoft.org>, > in sci.crypt Tom St Denis <tom@dasoft.org> wrote: > > > > > > >Terry Ritter wrote: > >> > >> On Fri, 21 Apr 2000 20:06:24 GMT, in <3900B5A5.A9805114@dasoft.org>, > >> in sci.crypt Tom St Denis <tom@dasoft.org> wrote: > >> > >> >[...] > >> >I meant used. The lastest used ciphers are 3des, cast128 and idea, all > >> >of which have had considerable analysis put against. Of course anybody > >> >can make a cipher that is trivial breakable. But those that have > >> >survived all our known tests, are secure. > >> > >> This flaunts the edge of what we know. Surviving *our* tests does not > >> make a cipher secure. A cipher is secure -- and protects our data -- > >> only when it survives the secret unknown attacks by our unknown > >> attackers. Those attackers do not announce their successes, so if > >> they are successful, we will never know. Even if the cipher has > >> survived all of our tests. > > > >If money starts disappearing we will know for sure. It may be too late > >but we will know. > > Yes, but that isn't the general reality of secret information. > Normally, there are various possible alternatives ("channels") for a > secret getting out, and there may be no real way to identify which > occurred. This is especially the case if the other side undertakes > operations to confuse the issue. > > In fact, normally we do not even know that the secret in fact did get > out; what we know, for example, is that a bid has been lost by an > extraordinarily close amount, and that could have been by chance. (In > wartime, we may lose a boat, but that happens.) We may have > suspicions, yet be unable quantify them to become sufficiently > convincing so that crypto users will change to another cipher. To get > the cipher changed, we almost need to prove something we cannot hope > to prove. > > It can be very, very difficult to identify a crypto leak as opposed to > some other leak, or just the effects of raw chance. Generally we will > not know for sure. Crypto leaks might occur fairly regularly on the > common systems in use today and we might well not know that. > > >Seriously though, it's good to be cautious, but when years of constant > >pressure and work cannot break an algorithm, it's most likely that it > >can't be done. > > The original issue was AES, and it certainly has not been all that > long for AES. For example, there is no way to know just how much > effort has been contributed, or what that effort covered. The whole > thing is sort of "Whatever." Well Twofish has been out for two years now, and I can imagine the team has spent hours and days working on it. They are the 'leading' people in the field (symmetric ciphers) so I would like to think they know what they are doing. And since everything in Twofish is documented I believe they actually did work. > >Take factoring for example. Been worked on for 1000s of years, and we > >still can't factor as fast as one would want to. Like nobody will > >really find the factors for > > > >n = > >7845464894948624085817674125006260680782223977132130103813467169531516537849\ > >05071193915597920110439954227055221771064236731175096156784015401689495213130748\ > >60509508765626164401372205205788363152458477780132197255553417102647530965046777\ > >799344029763540728789585552629530174624630219899102518383088153375672107 > > > >before I am long since dead. So there are problems that are just plain > >hard. > > Actually, I find factoring a good example: Looking to the past, it is > my impression that various great math minds have spent time on the > factoring problem, presumably because they had some intuition that > they could make progress. I respect such intuition, and the fact that > we still have a problem is not particularly comforting to me. Well things like the NFS and QS are certainly amazing advances in factoring, and maybe someday the time will change from 1.929 to 1.25 or something.... But as for now it's a usefull problem since it makes RSA [among other things] secure. Tom
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 05:56:50 GMT From: ritter@io.com (Terry Ritter) Message-ID: <39013ec5.4024894@news.io.com> References: <3900D7C1.B4D8FDB7@dasoft.org> Newsgroups: sci.crypt Lines: 20 On Fri, 21 Apr 2000 22:31:56 GMT, in <3900D7C1.B4D8FDB7@dasoft.org>, in sci.crypt Tom St Denis <tom@dasoft.org> wrote: >[...] >Well Twofish has been out for two years now, and I can imagine the team >has spent hours and days working on it. They are the 'leading' people >in the field (symmetric ciphers) so I would like to think they know what >they are doing. Even if what you would like to think is in fact true, "knowing what one is doing" in cryptography does NOT imply that the ciphers one builds can resist our opponents. This is a fundamental issue; to misunderstand it is to misunderstand what cryptography is about, and what cryptographic peer review can do. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 10:17:50 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <39017D36.AB06C1F@dasoft.org> References: <39013ec5.4024894@news.io.com> Newsgroups: sci.crypt Lines: 22 Terry Ritter wrote: > > On Fri, 21 Apr 2000 22:31:56 GMT, in <3900D7C1.B4D8FDB7@dasoft.org>, > in sci.crypt Tom St Denis <tom@dasoft.org> wrote: > > >[...] > >Well Twofish has been out for two years now, and I can imagine the team > >has spent hours and days working on it. They are the 'leading' people > >in the field (symmetric ciphers) so I would like to think they know what > >they are doing. > > Even if what you would like to think is in fact true, "knowing what > one is doing" in cryptography does NOT imply that the ciphers one > builds can resist our opponents. This is a fundamental issue; to > misunderstand it is to misunderstand what cryptography is about, and > what cryptographic peer review can do. Ok, what is the alternative? Tom
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 12:47:20 -0700 From: "Joseph Ashwood" <ashwood@email.msn.com> Message-ID: <OwKIvOJr$GA.238@cpmsnbbsa03> References: <39017D36.AB06C1F@dasoft.org> Newsgroups: sci.crypt Lines: 46 The short alternative is to do one of two things: 1) Trust {insert your favorite new believed secure cipher} and hope you're right 2) Trust {insert your favorite old believed secure cipher} and hope you're right For my personal data I do 1, but whenever I make a professional recommendation, I would rather be over right than over wrong, so I do 2, since it's generally a safer assumption. In the long run they really are the same, today's best cipher is tomorrow's yesterday's news. Joe "Tom St Denis" <tom@dasoft.org> wrote in message news:39017D36.AB06C1F@dasoft.org... > > > Terry Ritter wrote: > > > > On Fri, 21 Apr 2000 22:31:56 GMT, in <3900D7C1.B4D8FDB7@dasoft.org>, > > in sci.crypt Tom St Denis <tom@dasoft.org> wrote: > > > > >[...] > > >Well Twofish has been out for two years now, and I can imagine the team > > >has spent hours and days working on it. They are the 'leading' people > > >in the field (symmetric ciphers) so I would like to think they know what > > >they are doing. > > > > Even if what you would like to think is in fact true, "knowing what > > one is doing" in cryptography does NOT imply that the ciphers one > > builds can resist our opponents. This is a fundamental issue; to > > misunderstand it is to misunderstand what cryptography is about, and > > what cryptographic peer review can do. > > Ok, what is the alternative? > > Tom
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 00:34:50 GMT From: ritter@io.com (Terry Ritter) Message-ID: <390244e6.1721544@news.io.com> References: <39017D36.AB06C1F@dasoft.org> Newsgroups: sci.crypt Lines: 64 On Sat, 22 Apr 2000 10:17:50 GMT, in <39017D36.AB06C1F@dasoft.org>, in sci.crypt Tom St Denis <tom@dasoft.org> wrote: >Terry Ritter wrote: >> >> On Fri, 21 Apr 2000 22:31:56 GMT, in <3900D7C1.B4D8FDB7@dasoft.org>, >> in sci.crypt Tom St Denis <tom@dasoft.org> wrote: >> >> >[...] >> >Well Twofish has been out for two years now, and I can imagine the team >> >has spent hours and days working on it. They are the 'leading' people >> >in the field (symmetric ciphers) so I would like to think they know what >> >they are doing. >> >> Even if what you would like to think is in fact true, "knowing what >> one is doing" in cryptography does NOT imply that the ciphers one >> builds can resist our opponents. This is a fundamental issue; to >> misunderstand it is to misunderstand what cryptography is about, and >> what cryptographic peer review can do. > >Ok, what is the alternative? The first thing we can do is realize that cipher technology has nothing like the engineering and manufacturing control that we assume and expect in every other product we use and buy. Because of this, the present state of the art does not give us sufficient information to trust any cipher, no matter who has made or approved it. Consequently, we should avoid representing to others that a cipher is "probably" unbreakable, since we can have no real understanding of what those probabilities actually are. What we can do is to accept the unfortunate cryptographic reality as being beyond that addressed by conventional cryptographic wisdom. So if we are to improve our situation, it will be necessary to do something *different* from the way cryptography has been done in the past. For example, we might seek to innovate protocols and strategies which reduce our exposure and minimize our desirability as a target. And since we cannot know when we are being successfully attacked, we might seek to use ciphers in ways which terminate any such success. Endlessly using the same cipher as everyone else is to join the group which is the ideal target for attack. One alternative is to use ciphers which not everyone uses. Because less data are protected under these ciphers, they provide less payoff for successful attack, and that may reduce our opponents' motivation to choose us as their target. We can change ciphers frequently, which compartmentalizes our data, and also provides less payoff for a successful attack on any single cipher. Presumably there are various other approaches as well, but they all require *doing* something which has not generally been part of academic cryptography to date. That means we will not find these answers in cryptographic texts. In the end, we cannot trust the ciphers we use, no matter who has made or approved them. Doing the same as everybody else just makes us part of the most obvious and rewarding target. To improve our situation, we must do something beyond what conventional cryptography recommends. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 01:04:01 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <39024CDA.86295070@dasoft.org> References: <390244e6.1721544@news.io.com> Newsgroups: sci.crypt Lines: 55 Terry Ritter wrote: > >Ok, what is the alternative? > > The first thing we can do is realize that cipher technology has > nothing like the engineering and manufacturing control that we assume > and expect in every other product we use and buy. Because of this, > the present state of the art does not give us sufficient information > to trust any cipher, no matter who has made or approved it. > > Consequently, we should avoid representing to others that a cipher is > "probably" unbreakable, since we can have no real understanding of > what those probabilities actually are. > > What we can do is to accept the unfortunate cryptographic reality as > being beyond that addressed by conventional cryptographic wisdom. So > if we are to improve our situation, it will be necessary to do > something *different* from the way cryptography has been done in the > past. For example, we might seek to innovate protocols and strategies > which reduce our exposure and minimize our desirability as a target. > And since we cannot know when we are being successfully attacked, we > might seek to use ciphers in ways which terminate any such success. > > Endlessly using the same cipher as everyone else is to join the group > which is the ideal target for attack. One alternative is to use > ciphers which not everyone uses. Because less data are protected > under these ciphers, they provide less payoff for successful attack, > and that may reduce our opponents' motivation to choose us as their > target. We can change ciphers frequently, which compartmentalizes our > data, and also provides less payoff for a successful attack on any > single cipher. Presumably there are various other approaches as well, > but they all require *doing* something which has not generally been > part of academic cryptography to date. That means we will not find > these answers in cryptographic texts. > > In the end, we cannot trust the ciphers we use, no matter who has made > or approved them. Doing the same as everybody else just makes us part > of the most obvious and rewarding target. To improve our situation, > we must do something beyond what conventional cryptography recommends. You are not being realistic. We cannot throw away all current symmetric ciphers just because you feel less warm and fuzzy about them. Symmetric ciphers are used millions of times a day, and they do have an impact on theft and compromise, therefore they must be doing there job. True 100 years from now (or 50, or 25) AES may become weaker then conjectured, but for now we can assume that AES will be secure and not the point of attack. The alternative of course is to ditch all symmetric ciphers, send all information as plaintext and say "this is the best we can do". While your point of view is appropriate your attitude is not. Tom
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 19:20:28 -0700 From: "Joseph Ashwood" <ashwood@email.msn.com> Message-ID: <eNo9xqMr$GA.207@cpmsnbbsa03> References: <39024CDA.86295070@dasoft.org> Newsgroups: sci.crypt Lines: 53 > You are not being realistic. We cannot throw away all current symmetric > ciphers just because you feel less warm and fuzzy about them. Symmetric > ciphers are used millions of times a day, and they do have an impact on > theft and compromise, therefore they must be doing there job. Actually Ritter has to my knowledge never proposed such a drastic concept, what he has always encouraged, and I presume will rightfully continue encouraging, is that one should be realistic and more importantly conservative in our statements of the strength of a cipher. I generally try to make statements like "Cipher X is currently considered strong" or "There are no known useful attacks against cipher x in spte of the fact that it has been analysed heavily" > > True 100 years from now (or 50, or 25) AES may become weaker then I would say will almost certainly be weaker than we currently believe. > conjectured, but for now we can assume that AES will be secure and not > the point of attack. > > The alternative of course is to ditch all symmetric ciphers, send all > information as plaintext and say "this is the best we can do". No the alternative is to qualify what you say. Just as various people (including yourself) have made rather inflated claims of the security of an algorithm. Will we ever be able to judge the real security of a cipher? A very debatable proposition, but I do think that in time we will be able to make probable conjectures as to the strength of an algorithm, but I'm not sure if we can, generally, gain a high probability of correctness. Right now all we can say is that the expected strength against a certain attack is a value, but we cannot conjecture against unknown attacks. Perhaps I'm wrong, and we will never be able to raise the lower limit above 0. Either way it's a currently pointless exercise in argument, because our certainly is always 0. Mr Ritter has acknowledged this and has often sought to make it clear that in his view all we can do is stack the deck, so to speak, by taking precautions that would oft-times seem foolish to many. Joe
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 02:33:18 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <390261C8.27910321@dasoft.org> References: <eNo9xqMr$GA.207@cpmsnbbsa03> Newsgroups: sci.crypt Lines: 65 Joseph Ashwood wrote: > > > You are not being realistic. We cannot throw away all > current symmetric > > ciphers just because you feel less warm and fuzzy about > them. Symmetric > > ciphers are used millions of times a day, and they do have > an impact on > > theft and compromise, therefore they must be doing there > job. > Actually Ritter has to my knowledge never proposed such a > drastic concept, what he has always encouraged, and I > presume will rightfully continue encouraging, is that one > should be realistic and more importantly conservative in our > statements of the strength of a cipher. I generally try to > make statements like "Cipher X is currently considered > strong" or "There are no known useful attacks against cipher > x in spte of the fact that it has been analysed heavily" > > > > > True 100 years from now (or 50, or 25) AES may become > weaker then > > I would say will almost certainly be weaker than we > currently believe. > > > conjectured, but for now we can assume that AES will be > secure and not > > the point of attack. > > > > The alternative of course is to ditch all symmetric > ciphers, send all > > information as plaintext and say "this is the best we can > do". > No the alternative is to qualify what you say. Just as > various people (including yourself) have made rather > inflated claims of the security of an algorithm. > > Will we ever be able to judge the real security of a cipher? > A very debatable proposition, but I do think that in time we > will be able to make probable conjectures as to the strength > of an algorithm, but I'm not sure if we can, generally, gain > a high probability of correctness. Right now all we can say > is that the expected strength against a certain attack is a > value, but we cannot conjecture against unknown attacks. > Perhaps I'm wrong, and we will never be able to raise the > lower limit above 0. Either way it's a currently pointless > exercise in argument, because our certainly is always 0. Mr > Ritter has acknowledged this and has often sought to make it > clear that in his view all we can do is stack the deck, so > to speak, by taking precautions that would oft-times seem > foolish to many. > Joe This is pure garbage. We can measure the security of a cipher right now. Are our measurements definative? No. We can tell when a cipher is obviously or subtly flawed (DES, FEAl, RC5, Blowfish, CAST, 3-WAY, IDEA, RC2, RC6, Twofish, Serpent..... all have detected problems). But is it conclusive? No really. Just like any statistiscal test is not the final answer. Tom
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 19:48:22 -0700 From: "Joseph Ashwood" <ashwood@email.msn.com> Message-ID: <OJYak9Mr$GA.235@cpmsnbbsa03> References: <390261C8.27910321@dasoft.org> Newsgroups: sci.crypt Lines: 46 > This is pure garbage. On what grounds. My statements are effectively: 1) We cannot know the abosulte security of a cipher 2) We cannot yet put a lower bound on the security above 0 3) We cannot determine if we have found the best attack against a cipher 4) Ritter has said all these in different ways. 5) It is almost certain that in 25 years we will have better attacks against whatever is chosen for AES 6) That you should not misrepresent the state of the art by saying something is secure (which implies proof of some kind, beyond anecdotal) 7) That by following Ritter's arguments closely you can help prevent finding your understood security reduced to 0 8) the steps required to increase your odds of security are not obvious to many people (I can show you many programs that anecdotally prove this statement) Everything else was clearly stated as conjecture, not as fact. >We can measure the security of a cipher right > now. Are our measurements definative? No. Ok, give me the lower bound of the security of DES? Even approximations. > > We can tell when a cipher is obviously or subtly flawed (DES, FEAl, RC5, > Blowfish, CAST, 3-WAY, IDEA, RC2, RC6, Twofish, Serpent..... all have > detected problems). But is it conclusive? No really. Just like any > statistiscal test is not the final answer. It gives us an absolute upper bound on the security, but we still do not have a lower bound. Your conclusion based on this was that the alternative is to throw all our ciphers away. you have once again not seen all the possibilities, you can increase the probability that the actual lower bound of security is above 0 by doing various things. Joe
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 02:22:55 GMT From: ritter@io.com (Terry Ritter) Message-ID: <39025dda.8110286@news.io.com> References: <39024CDA.86295070@dasoft.org> Newsgroups: sci.crypt Lines: 108 On Sun, 23 Apr 2000 01:04:01 GMT, in <39024CDA.86295070@dasoft.org>, in sci.crypt Tom St Denis <tom@dasoft.org> wrote: >Terry Ritter wrote: >> >Ok, what is the alternative? >> >> The first thing we can do is realize that cipher technology has >> nothing like the engineering and manufacturing control that we assume >> and expect in every other product we use and buy. Because of this, >> the present state of the art does not give us sufficient information >> to trust any cipher, no matter who has made or approved it. >> >> Consequently, we should avoid representing to others that a cipher is >> "probably" unbreakable, since we can have no real understanding of >> what those probabilities actually are. >> >> What we can do is to accept the unfortunate cryptographic reality as >> being beyond that addressed by conventional cryptographic wisdom. So >> if we are to improve our situation, it will be necessary to do >> something *different* from the way cryptography has been done in the >> past. For example, we might seek to innovate protocols and strategies >> which reduce our exposure and minimize our desirability as a target. >> And since we cannot know when we are being successfully attacked, we >> might seek to use ciphers in ways which terminate any such success. >> >> Endlessly using the same cipher as everyone else is to join the group >> which is the ideal target for attack. One alternative is to use >> ciphers which not everyone uses. Because less data are protected >> under these ciphers, they provide less payoff for successful attack, >> and that may reduce our opponents' motivation to choose us as their >> target. We can change ciphers frequently, which compartmentalizes our >> data, and also provides less payoff for a successful attack on any >> single cipher. Presumably there are various other approaches as well, >> but they all require *doing* something which has not generally been >> part of academic cryptography to date. That means we will not find >> these answers in cryptographic texts. >> >> In the end, we cannot trust the ciphers we use, no matter who has made >> or approved them. Doing the same as everybody else just makes us part >> of the most obvious and rewarding target. To improve our situation, >> we must do something beyond what conventional cryptography recommends. > >You are not being realistic. We cannot throw away all current symmetric >ciphers just because you feel less warm and fuzzy about them. Symmetric >ciphers are used millions of times a day, and they do have an impact on >theft and compromise, therefore they must be doing there job. Nonsense. It is *you* who are not being realistic: Being realistic means addressing facts and reality. Our limitations in knowing cipher strength are obvious facts. You can stick your head in the sand, but the facts will remain nevertheless. I have not suggested that we "throw away all current symmetric ciphers." As far as I can tell you made that up. Using asymmetric ciphers would not change the basic problem. >True 100 years from now (or 50, or 25) AES may become weaker then >conjectured, but for now we can assume that AES will be secure and not >the point of attack. First, AES cannot "become weaker;" any particular design will not change through time. So if AES would be weaker in 100 years, it is weaker *now*. It is only "our" knowledge that may change. But *our* knowledge is *not* the same as our opponents' knowledge, and that is the problem. We simply have no basis for assuming that our opponents have the same limitations we do. Personally, I expect that some of our unknown opponents are far more accomplished than any academic we know. Simply *assuming* that AES is secure is unwarranted, and encouraging others to believe this is actually *deceptive*, unless of course you have evidence to back up your claim. But there is no such evidence. You can assume whatever you want, but there is no scientific basis for it. That is not reality, and that is not being realistic. >The alternative of course is to ditch all symmetric ciphers, send all >information as plaintext and say "this is the best we can do". That would be *your* alternative. I would not suggest that, and I have described whole ranges of more appropriate alternatives. >While your point of view is appropriate your attitude is not. >Tom My attitude? You mean like addressing uncomfortable reality instead of insisting that it does not exist, or that we can't do anything about it anyway? Well, yes, I guess my "attitude" would be uncomfortable if you assume that the conventional wisdom knows best, and all that society needs to know has been properly addressed by academics. But in this case it does not take very much insight to see that such an assumption is appallingly, obviously and massively false. Conventional cryptography is built on a foundation of sand. Until the ramifications of a contest against unknown and unknowable opponents are addressed, there can be no deep understanding of what cryptography means or what it can realistically provide. That would be distinctly different from assuming a cipher is strong because everybody thinks it must be. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 02:30:31 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <39026120.ADB89560@dasoft.org> References: <39025dda.8110286@news.io.com> Newsgroups: sci.crypt Lines: 71 Terry Ritter wrote: > >True 100 years from now (or 50, or 25) AES may become weaker then > >conjectured, but for now we can assume that AES will be secure and not > >the point of attack. > > First, AES cannot "become weaker;" any particular design will not > change through time. So if AES would be weaker in 100 years, it is > weaker *now*. It is only "our" knowledge that may change. But *our* > knowledge is *not* the same as our opponents' knowledge, and that is > the problem. We simply have no basis for assuming that our opponents > have the same limitations we do. Personally, I expect that some of > our unknown opponents are far more accomplished than any academic we > know. That's the thing, a cipher is only insecure if we know it is. If 99.99999% of all the people on earth cannot break a cipher, then I will use it. Them's the facts. Cuz I really only want to use a cipher to keep people like you, and the rest of the group from snooping in my email, etc.. If only one person in this world can read my private email (other then the intentends) good for him/her. > Simply *assuming* that AES is secure is unwarranted, and encouraging > others to believe this is actually *deceptive*, unless of course you > have evidence to back up your claim. But there is no such evidence. > You can assume whatever you want, but there is no scientific basis for > it. That is not reality, and that is not being realistic. > >The alternative of course is to ditch all symmetric ciphers, send all > >information as plaintext and say "this is the best we can do". > > That would be *your* alternative. I would not suggest that, and I > have described whole ranges of more appropriate alternatives. Such as, in your point of view no prng is secure, therefor we are back to the OTP... > >While your point of view is appropriate your attitude is not. > >Tom > > My attitude? You mean like addressing uncomfortable reality instead > of insisting that it does not exist, or that we can't do anything > about it anyway? Well, yes, I guess my "attitude" would be > uncomfortable if you assume that the conventional wisdom knows best, > and all that society needs to know has been properly addressed by > academics. But in this case it does not take very much insight to see > that such an assumption is appallingly, obviously and massively false. Some caution is warranted, but you have to work with what you are given. If I had to make a program to encrypt money transactions, I would rather use DES with it's 56 bit key then nothing. Likewise with the AES ciphers. > Conventional cryptography is built on a foundation of sand. Until the > ramifications of a contest against unknown and unknowable opponents > are addressed, there can be no deep understanding of what cryptography > means or what it can realistically provide. That would be distinctly > different from assuming a cipher is strong because everybody thinks it > must be. People don't just say "oh it looks strong". People attack it from every which angle and say this is the best we can do. Then others do similar. After 100s of people do similar we can assume it's most likely secure. Which is more probable though. Having 1000s of scientists test, probe and disect the cipher to find no real flaws, only to have a hidden group find the flaws? or that they didn't find anything because we won't find anything? Tom
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 07:15:11 GMT From: ritter@io.com (Terry Ritter) Message-ID: <3902a213.1647615@news.io.com> References: <39026120.ADB89560@dasoft.org> Newsgroups: sci.crypt Lines: 113 On Sun, 23 Apr 2000 02:30:31 GMT, in <39026120.ADB89560@dasoft.org>, in sci.crypt Tom St Denis <tom@dasoft.org> wrote: >Terry Ritter wrote: >> >True 100 years from now (or 50, or 25) AES may become weaker then >> >conjectured, but for now we can assume that AES will be secure and not >> >the point of attack. >> >> First, AES cannot "become weaker;" any particular design will not >> change through time. So if AES would be weaker in 100 years, it is >> weaker *now*. It is only "our" knowledge that may change. But *our* >> knowledge is *not* the same as our opponents' knowledge, and that is >> the problem. We simply have no basis for assuming that our opponents >> have the same limitations we do. Personally, I expect that some of >> our unknown opponents are far more accomplished than any academic we >> know. > >That's the thing, a cipher is only insecure if we know it is. *Our* knowledge has nothing to do with it. It is our opponents' knowledge which defines insecurity. If all we have to do to keep a cipher strong is to not break it and not hear about breaking it, I see no reason why we would ever have any weak ciphers at all. Good cryptography is not about pretense; it is about actually confronting informed opponents and winning, despite their best efforts. >If >99.99999% of all the people on earth cannot break a cipher, then I will >use it. Them's the facts. Cuz I really only want to use a cipher to >keep people like you, and the rest of the group from snooping in my >email, etc.. If only one person in this world can read my private email >(other then the intentends) good for him/her. > >> Simply *assuming* that AES is secure is unwarranted, and encouraging >> others to believe this is actually *deceptive*, unless of course you >> have evidence to back up your claim. But there is no such evidence. >> You can assume whatever you want, but there is no scientific basis for >> it. That is not reality, and that is not being realistic. >> >The alternative of course is to ditch all symmetric ciphers, send all >> >information as plaintext and say "this is the best we can do". >> >> That would be *your* alternative. I would not suggest that, and I >> have described whole ranges of more appropriate alternatives. > >Such as, in your point of view no prng is secure, therefor we are back >to the OTP... "In my point of view," I do suspect that no PRNG can be *provably* secure. After considerable experience, I now expect to always find some sort of assumption which prevents a full security proof. Nor do I accept the conventional wisdom that any practical OTP is absolutely secure. In my view, the only provably secure OTP is the one we think about and never use. As soon as we start to use something like an OTP, it no longer has the provable characteristics we thought it would have. But my whole here is not that any cipher can be insecure, but that we have options beyond the security of the cipher per se; that is, beyond what we cannot hope to prove. We can take other actions to improve even our horrible situation. >> >While your point of view is appropriate your attitude is not. >> >Tom >> >> My attitude? You mean like addressing uncomfortable reality instead >> of insisting that it does not exist, or that we can't do anything >> about it anyway? Well, yes, I guess my "attitude" would be >> uncomfortable if you assume that the conventional wisdom knows best, >> and all that society needs to know has been properly addressed by >> academics. But in this case it does not take very much insight to see >> that such an assumption is appallingly, obviously and massively false. > >Some caution is warranted, but you have to work with what you are >given. If I had to make a program to encrypt money transactions, I >would rather use DES with it's 56 bit key then nothing. Likewise with >the AES ciphers. > >> Conventional cryptography is built on a foundation of sand. Until the >> ramifications of a contest against unknown and unknowable opponents >> are addressed, there can be no deep understanding of what cryptography >> means or what it can realistically provide. That would be distinctly >> different from assuming a cipher is strong because everybody thinks it >> must be. > >People don't just say "oh it looks strong". People attack it from every >which angle and say this is the best we can do. Then others do >similar. After 100s of people do similar we can assume it's most likely >secure. We can't define security by the number of people who have tried and failed! Where do you get this stuff? All it takes is for one to succeed and security is gone. >Which is more probable though. Having 1000s of scientists test, probe >and disect the cipher to find no real flaws, only to have a hidden group >find the flaws? or that they didn't find anything because we won't find >anything? I think it is probable that hidden groups do contain substantial expertise which is not available in the open literature. Given that, is possible weakness all that improbable? --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 04:38:34 GMT From: jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) Message-ID: <39027d06.648883@news.ecn.ab.ca> References: <39025dda.8110286@news.io.com> Newsgroups: sci.crypt Lines: 25 On Sun, 23 Apr 2000 02:22:55 GMT, ritter@io.com (Terry Ritter) wrote, in part: >I have not suggested that we "throw away all current symmetric >ciphers." As far as I can tell you made that up. Using asymmetric >ciphers would not change the basic problem. In my opinion, it would probably make the problem much worse, but it still wouldn't be quite as bad as you appear to be claiming it is. Yes, we can't prove a cipher to be secure. But in virtually all civilian applications of cryptography, the vulnerability to attacks other than cryptanalysis is so great that, after using something of the Triple-DES or AES class for encryption, spending more time and effort on that part of security, rather than going where the real problems are, is a waste of time. But people are even *less* disposed to do the other things required for security than they are to use decent ciphers. Thus, I'm not surprised at all that reputable security experts tend to dismiss concerns about the security of today's high-standard ciphers. In an abstract, absolute sense, that may not be right; but in the real world, it is indeed appropriate. John Savard (teneerf <-)
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 07:20:37 GMT From: ritter@io.com (Terry Ritter) Message-ID: <3902a30e.1899005@news.io.com> References: <39027d06.648883@news.ecn.ab.ca> Newsgroups: sci.crypt Lines: 50 On Sun, 23 Apr 2000 04:38:34 GMT, in <39027d06.648883@news.ecn.ab.ca>, in sci.crypt jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) wrote: >On Sun, 23 Apr 2000 02:22:55 GMT, ritter@io.com (Terry Ritter) wrote, >in part: > >>I have not suggested that we "throw away all current symmetric >>ciphers." As far as I can tell you made that up. Using asymmetric >>ciphers would not change the basic problem. > >In my opinion, it would probably make the problem much worse, but it >still wouldn't be quite as bad as you appear to be claiming it is. > >Yes, we can't prove a cipher to be secure. > >But in virtually all civilian applications of cryptography, the >vulnerability to attacks other than cryptanalysis is so great that, >after using something of the Triple-DES or AES class for encryption, >spending more time and effort on that part of security, rather than >going where the real problems are, is a waste of time. But people are >even *less* disposed to do the other things required for security than >they are to use decent ciphers. Once again we have the hidden assumption which I question: That you know the cipher to be more secure than other insecurities in the system. Now, you may think that, and you may believe that, and for all I know everybody else does too, but neither you nor anybody else actually *knows* that. That is an assumption for which there is no evidence. It is a particularly comforting belief, and no more. You do *not* know that there is no break which is easier than whatever other weakness is in the system. But I suggest we make the rest of the system hard instead of depending on it as an excuse to not worry about cipher strength. >Thus, I'm not surprised at all that reputable security experts tend to >dismiss concerns about the security of today's high-standard ciphers. >In an abstract, absolute sense, that may not be right; but in the real >world, it is indeed appropriate. Sorry, but that is *not* appropriate. That does *not* address the cryptographic reality we confront. That attitude is just claims and dreams. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 14:36:24 GMT From: jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) Message-ID: <39030910.788052@news.ecn.ab.ca> References: <3902a30e.1899005@news.io.com> Newsgroups: sci.crypt Lines: 30 On Sun, 23 Apr 2000 07:20:37 GMT, ritter@io.com (Terry Ritter) wrote, in part: >Once again we have the hidden assumption which I question: That you >know the cipher to be more secure than other insecurities in the >system. Now, you may think that, and you may believe that, and for >all I know everybody else does too, but neither you nor anybody else >actually *knows* that. That is an assumption for which there is no >evidence. It is a particularly comforting belief, and no more. >You do *not* know that there is no break which is easier than whatever >other weakness is in the system. But I suggest we make the rest of >the system hard instead of depending on it as an excuse to not worry >about cipher strength. Well, I _do_ "know that" in at least _one_ sense. Unlike information about the vulnerabilities nobody who's _telling_ knows about in the ciphers, the information on how to exploit the _other_ weaknesses in the system is _already publicly available_. And by this I don't just mean "kiddie scripts". Starting from general principles of hacking, the effort required to break into a computer system is simply in another league from the effort required to develop new cryptanalytic attacks. Worrying about, say, organized crime having access to cryptanalytic research years in advance of public knowlege is not realistic, and many users of cryptography do not have major governments as their opponents. John Savard (teneerf <-)
Subject: Re: The Illusion of Security Date: Mon, 24 Apr 2000 01:28:43 -0700 From: ritter <ritterNOriSPAM@io.com.invalid> Message-ID: <29839f23.df4b8e06@usw-ex0105-036.remarq.com> References: <39035282.66589C84@aspi.net> <3902a30e.1899005@news.io.com> Newsgroups: sci.crypt Lines: 35 (Not all the messages are coming in, and some of my messages are apparently getting lost going out.) In article <39035282.66589C84@aspi.net>, "Trevor L. Jackson, III" <fullmoon@aspi.net> wrote: >[...] >In light of my comments above and your concluding remark, what _is_ an >appropriate attitude? 1. We cannot trust any cipher. The academic peer-review process does not claim to produce unbreakable ciphers. The ciphers we get thus have a very real possibility of weakness. 2. We cannot know the possibility of cipher weakness, because this occurs at the opponent in secrecy. We simply do not have evidence to state that a break is improbable or infrequent. We are thus forced to assume that exposure is likely and common. 3. The more often a cipher is used, the more ciphertext is available for analysis, and the greater the value of the information protected by that cipher. A massively-used cipher is thus the most inviting target. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM * Sent from RemarQ http://www.remarq.com The Internet's Discussion Network * The fastest and easiest way to search and participate in Usenet - Free!
Subject: Re: The Illusion of Security Date: Sun, 30 Apr 2000 20:23:24 -0700 From: Diet NSA <the_nsa@my-deja.com> Message-ID: <030ec466.65d1f677@usw-ex0105-035.remarq.com> References: <29839f23.df4b8e06@usw-ex0105-036.remarq.com> Newsgroups: sci.crypt Lines: 34 In article <29839f23.df4b8e06@usw- ex0105-036.remarq.com>, ritter < ritterNOriSPAM@io.com.invalid> wrote: >1. We cannot trust any cipher. The academic peer-review >process does not claim to produce unbreakable ciphers. >The ciphers we get thus have a very real possibility of >weakness. > >2. We cannot know the possibility of cipher weakness, >because this occurs at the opponent in secrecy. We >simply do not have evidence to state that a break is >improbable or infrequent. We are thus forced to assume >that exposure is likely and common. > >3. The more often a cipher is used, the more ciphertext >is available for analysis, and the greater the value >of the information protected by that cipher. A >massively-used cipher is thus the most inviting target. > These statements are true for classical crypto, but not necessarily true for the quantum case. I am saying this only for the sake of completeness, and do *not* mean to fault you because you were not making any claims about quantum crypto. " V hfdt afogx nfvw ufo axb (o)(o) " - Gtnjv ---------------------------------------------------- * Sent from RemarQ http://www.remarq.com The Internet's Discussion Network * The fastest and easiest way to search and participate in Usenet - Free!
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 04:32:38 GMT From: jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) Message-ID: <39027bab.301501@news.ecn.ab.ca> References: <390244e6.1721544@news.io.com> Newsgroups: sci.crypt Lines: 22 On Sun, 23 Apr 2000 00:34:50 GMT, ritter@io.com (Terry Ritter) wrote, in part: >In the end, we cannot trust the ciphers we use, no matter who has made >or approved them. Doing the same as everybody else just makes us part >of the most obvious and rewarding target. To improve our situation, >we must do something beyond what conventional cryptography recommends. On the other hand, "following the herd" does have the real advantage that one is using a cipher that has been studied - so at least we know it is not vulnerable to attacks _already publicly known_. In general, doing something _else_ doesn't even give us that level of assurance; there is way too much snake oil out there, and the average person intending to use cryptography is not able to tell the bad from the good at this level. One _can_ go beyond conventional cryptography while still using it, for example, by a cascade of ciphers including one of the academic favorites. I agree with you that this kind of thing is a good idea. But I also see why calls for a more open-minded approach to cipher choice are looked upon with great skepticism. John Savard (teneerf <-)
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 07:21:56 GMT From: ritter@io.com (Terry Ritter) Message-ID: <3902a448.2212897@news.io.com> References: <39027bab.301501@news.ecn.ab.ca> Newsgroups: sci.crypt Lines: 39 On Sun, 23 Apr 2000 04:32:38 GMT, in <39027bab.301501@news.ecn.ab.ca>, in sci.crypt jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) wrote: >On Sun, 23 Apr 2000 00:34:50 GMT, ritter@io.com (Terry Ritter) wrote, >in part: > >>In the end, we cannot trust the ciphers we use, no matter who has made >>or approved them. Doing the same as everybody else just makes us part >>of the most obvious and rewarding target. To improve our situation, >>we must do something beyond what conventional cryptography recommends. > >On the other hand, "following the herd" does have the real advantage >that one is using a cipher that has been studied - so at least we know >it is not vulnerable to attacks _already publicly known_. True. >In general, >doing something _else_ doesn't even give us that level of assurance; Also true. >there is way too much snake oil out there, and the average person >intending to use cryptography is not able to tell the bad from the >good at this level. > >One _can_ go beyond conventional cryptography while still using it, >for example, by a cascade of ciphers including one of the academic >favorites. I agree with you that this kind of thing is a good idea. >But I also see why calls for a more open-minded approach to cipher >choice are looked upon with great skepticism. Oddly, I do not. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 14:49:27 GMT From: jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) Message-ID: <39030a8a.1166189@news.ecn.ab.ca> References: <3902a448.2212897@news.io.com> Newsgroups: sci.crypt Lines: 28 On Sun, 23 Apr 2000 07:21:56 GMT, ritter@io.com (Terry Ritter) wrote, in part: >On Sun, 23 Apr 2000 04:32:38 GMT, in <39027bab.301501@news.ecn.ab.ca>, >in sci.crypt jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) wrote: >>But I also see why calls for a more open-minded approach to cipher >>choice are looked upon with great skepticism. >Oddly, I do not. The reason why is nothing more than those two previous points which you acknowleged as true. Those are sufficient reason for skepticism. A "more open-minded approach to cipher choice" is something that appears likely to remove, for most users, the advantage of "following the herd"; to leave them bereft even of resistance to known attacks. But you are right if you mean they are not sufficient reason for rejecting all new ideas out of hand completely. Your multi-ciphering proposal, for example, met this particular objection. I've raised what is, in my mind, the most serious objection to it in its present form: that to realize some of the advantages that are hoped for from it, specifically a broad marketplace for cipher designs, one has to have a setup so open that vulnerability to malicious code appears to stop being a controllable threat, without elaborate precautions such as the use of P-code. The objections concerning cryptographic security were met. John Savard (teneerf <-)
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 22:54:22 GMT From: ritter@io.com (Terry Ritter) Message-ID: <39037f18.5792855@news.io.com> References: <39030a8a.1166189@news.ecn.ab.ca> Newsgroups: sci.crypt Lines: 97 On Sun, 23 Apr 2000 14:49:27 GMT, in <39030a8a.1166189@news.ecn.ab.ca>, in sci.crypt jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) wrote: >On Sun, 23 Apr 2000 07:21:56 GMT, ritter@io.com (Terry Ritter) wrote, >in part: >>On Sun, 23 Apr 2000 04:32:38 GMT, in <39027bab.301501@news.ecn.ab.ca>, >>in sci.crypt jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) wrote: > >>>But I also see why calls for a more open-minded approach to cipher >>>choice are looked upon with great skepticism. > >>Oddly, I do not. > >The reason why is nothing more than those two previous points which >you acknowleged as true. Those are sufficient reason for skepticism. No. It is true that every new cipher cannot possibly have had review as deep as ciphers which have gone before. That's what "new" means. That is the situation with *every* new cipher, including, for example, AES. But AES has not had a *controlled* review, such as accounting the time spent by each investigator, the various avenues considered, with negative (often academically unpublishable) results. Without that information we have no idea how deep the investigation has gone. Thus we reap the rewards of begging investigators to contribute their time for free. What a surprise. Every new cipher needs review, and if we have more ciphers, they all need to be reviewed. But at least that *can* be done. The alternative problem is to find weaknesses about which we do not know, and *that* almost *cannot* be done. So under my proposals we have a system which we *can* improve, by improving the quality of the ciphers, but we do not trust that any cipher is secure. In contrast, the conventional wisdom of using a single cipher gives us a system whose weaknesses (yes, if any!) we cannot expect to either detect or fix. The conventional wisdom thus requires us to trust a single cipher but does not give us the tools to do so. >A >"more open-minded approach to cipher choice" is something that appears >likely to remove, for most users, the advantage of "following the >herd"; to leave them bereft even of resistance to known attacks. > >But you are right if you mean they are not sufficient reason for >rejecting all new ideas out of hand completely. How good of you to have decided that rejecting all new ideas out of hand is not always the best policy. >Your multi-ciphering >proposal, for example, met this particular objection. Yes, I believe it has. >I've raised what is, in my mind, the most serious objection to it in >its present form: that to realize some of the advantages that are >hoped for from it, specifically a broad marketplace for cipher >designs, one has to have a setup so open that vulnerability to >malicious code appears to stop being a controllable threat, without >elaborate precautions such as the use of P-code. The objections >concerning cryptographic security were met. And I have responded that this problem exists for every ciphering system whatsoever. P-code has never been a solution. If we get a cipher executable off the net, we really have no idea what we get. But if we must assemble and link source code to use the cipher, we will be part of a remarkably small group. So these are also not solutions. If we get a cipher with a system we buy, we *assume* the manufacturer has obtained the correct program, an assumption which could of course be false. But we can at least verify that we have the correct file. File verification by cryptographic hash is well-known technology. No doubt it can be defeated, and even in the best case it only tells us that we have exactly what our supplier wanted to give us. It thus places the responsibility on the creator of the goods, which probably means we have to pay and trust those guys. But to verify the cipher, I think it is vital that we have an open system specification in which we can replace the existing cipher with what we could obtain if we could compile source code. Any acceptable system is going to have to allow us to change the cipher used by the rest of the system. Personally, I believe the ability to change ciphers is the last-ditch stand for some people who do not want the population to have unbreakable ciphering, so that feature may be hard for a manufacturer to offer. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: 25 Apr 2000 01:55:50 EDT From: guymacon@deltanet.com (Guy Macon) Message-ID: <8e3c16$se2@chronicle.concentric.net> References: <39037f18.5792855@news.io.com> Newsgroups: sci.crypt Lines: 10 In article <39037f18.5792855@news.io.com>, ritter@io.com (Terry Ritter) wrote: >If we get a cipher executable off the net, we really have no idea what >we get. But if we must assemble and link source code to use the >cipher, we will be part of a remarkably small group. So these are >also not solutions. What do you think of the solution to this particular problem proposed at [ http://www.ciphersaber.gurus.com ]?
Subject: Re: The Illusion of Security Date: Tue, 25 Apr 2000 07:09:49 GMT From: ritter@io.com (Terry Ritter) Message-ID: <390544b8.6982110@news.io.com> References: <8e3c16$se2@chronicle.concentric.net> Newsgroups: sci.crypt Lines: 25 On 25 Apr 2000 01:55:50 EDT, in <8e3c16$se2@chronicle.concentric.net>, in sci.crypt guymacon@deltanet.com (Guy Macon) wrote: >In article <39037f18.5792855@news.io.com>, ritter@io.com (Terry Ritter) wrote: > >>If we get a cipher executable off the net, we really have no idea what >>we get. But if we must assemble and link source code to use the >>cipher, we will be part of a remarkably small group. So these are >>also not solutions. > >What do you think of the solution to this particular problem proposed at >[ http://www.ciphersaber.gurus.com ]? It would help me to know what you think the solution was. Since I think only a small group would even compile source, I expect it would be an even smaller group who would actually construct the source themselves. Many of those who could do that might disagree with the cipher design and so not want to. That doesn't sound like a solution for society, but some hobbyists might like it. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: 25 Apr 2000 05:25:17 EDT From: guymacon@deltanet.com (Guy Macon) Message-ID: <8e3o9t$sa7@chronicle.concentric.net> References: <390544b8.6982110@news.io.com> Newsgroups: sci.crypt Lines: 29 In article <390544b8.6982110@news.io.com>, ritter@io.com (Terry Ritter) wrote: > > >On 25 Apr 2000 01:55:50 EDT, in <8e3c16$se2@chronicle.concentric.net>, >in sci.crypt guymacon@deltanet.com (Guy Macon) wrote: > >>In article <39037f18.5792855@news.io.com>, ritter@io.com (Terry Ritter) wrote: >> >>>If we get a cipher executable off the net, we really have no idea what >>>we get. But if we must assemble and link source code to use the >>>cipher, we will be part of a remarkably small group. So these are >>>also not solutions. >> >>What do you think of the solution to this particular problem proposed at >>[ http://www.ciphersaber.gurus.com ]? > >It would help me to know what you think the solution was. Since I >think only a small group would even compile source, I expect it would >be an even smaller group who would actually construct the source >themselves. Many of those who could do that might disagree with the >cipher design and so not want to. That doesn't sound like a solution >for society, but some hobbyists might like it. > Sounds about right. I sometimes forget that most people aren't like me, my biologist wife, or my engineer buddies. It has crossed my mind to write up a Ciphersaber Excel spreadsheet...
Subject: Re: The Illusion of Security Date: Sun, 23 Apr 2000 20:37:33 GMT From: Boris Kazak <bkazak@worldnet.att.net> Message-ID: <39035F20.2499E7D@worldnet.att.net> References: <3900d457.3579114@news.io.com> Newsgroups: sci.crypt Lines: 27 Terry Ritter wrote: > > On Fri, 21 Apr 2000 21:58:30 GMT, in <3900CFEB.3B1884AA@dasoft.org>, > in sci.crypt Tom St Denis <tom@dasoft.org> wrote: ************ > >If money starts disappearing we will know for sure. It may be too late > >but we will know. **************** > In fact, normally we do not even know that the secret in fact did get > out; what we know, for example, is that a bid has been lost by an > extraordinarily close amount, and that could have been by chance. (In > wartime, we may lose a boat, but that happens.) We may have > suspicions, yet be unable quantify them to become sufficiently > convincing so that crypto users will change to another cipher. To get > the cipher changed, we almost need to prove something we cannot hope > to prove. > ************* You don't need to know that! You _must_ assume that your cipher is broken and your keys revealed if you had used them for over 1 week. Change them, this is the only way to play it somehow safe. Best wishes BNK ********************** > Terry Ritter ritter@io.com http://www.io.com/~ritter/ > Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Mon, 24 Apr 2000 16:13:34 -0600 From: Jerry Coffin <jcoffin@taeus.com> Message-ID: <MPG.136e4e5ec763e08c98981c@news.mindspring.com> References: <3900d457.3579114@news.io.com> Newsgroups: sci.crypt Lines: 30 In article <3900d457.3579114@news.io.com>, ritter@io.com says... [ ... ] > Actually, I find factoring a good example: Looking to the past, it is > my impression that various great math minds have spent time on the > factoring problem, presumably because they had some intuition that > they could make progress. I respect such intuition, and the fact that > we still have a problem is not particularly comforting to me. ...particuarly when no less than _tremendous_ progress has been made. Tom mentioned factoring having been studied for a thousand years or so, and still not being as fast as we'd like. The reality is that until relatively recently, factoring was studied almost entirely by more or less the "lunatic fringe" of mathematicians -- until RSA was invented, factoring was among the least useful occupations known to man, and only a very small number of people cared about it at all. Looking at things from the opposing viewpoint, consider that the majority of advances in factoring have been made by people who are still alive. There's basically only one time in history in which it's possible that as much progress in factoring was made as in the last 30 years or so, and that would be the time of Fermat and Mersenne. -- Later, Jerry. The universe is a figment of its own imagination.
Subject: Re: The Illusion of Security Date: Thu, 4 May 2000 23:42:38 GMT From: Tim Tyler <tt@cryogen.com> Message-ID: <Fu2772.1Fn@bath.ac.uk> References: <MPG.136e4e5ec763e08c98981c@news.mindspring.com> Newsgroups: sci.crypt Lines: 12 Jerry Coffin <jcoffin@taeus.com> wrote: : The reality is that until relatively recently, factoring was : studied almost entirely by more or less the "lunatic fringe" : of mathematicians -- until RSA was invented, factoring was among : the least useful occupations known to man, and only a very small : number of people cared about it at all. Enough to make one wonder where the "lunatic fringe" is at work today ;-) -- __________ Lotus Artificial Life http://alife.co.uk/ tt@cryogen.com |im |yler The Mandala Centre http://mandala.co.uk/ This tagline no verb.
Subject: Re: The Illusion of Security Date: Thu, 27 Apr 2000 13:15:14 -0700 From: Diet NSA <the_nsa@my-deja.com> Message-ID: <0a7712fc.92a4a6ab@usw-ex0101-005.remarq.com> References: <3900CFEB.3B1884AA@dasoft.org> Newsgroups: sci.crypt Lines: 24 In article <3900CFEB.3B1884AA@dasoft.org>, Tom St Denis <tom@dasoft.org> wrote: >Take factoring for example. Been worked on for 1000s of years, and we >still can't factor as fast as one would want to. Like nobody will >really find the factors for [snip] >before I am long since dead. So there are problems that are just plain >hard. > Actually, there is no public proof that factoring is hard. Anyways, the problem of factoring in polynomial time has already been solved theoretically by Peter Shor. His solution, a famous quantum factorization algorithm, might be implemented during your lifetime in a large & robust enough way to be relevant for crypto. " V hfdt afogx nfvw ufo axb (o)(o) " - Gtnjv ---------------------------------------------------- * Sent from RemarQ http://www.remarq.com The Internet's Discussion Network * The fastest and easiest way to search and participate in Usenet - Free!
Subject: Re: The Illusion of Security Date: Fri, 21 Apr 2000 21:56:07 GMT From: ritter@io.com (Terry Ritter) Message-ID: <3900ce05.1961547@news.io.com> References: <#btnDt8q$GA.303@cpmsnbbsa04> Newsgroups: sci.crypt Lines: 23 On Fri, 21 Apr 2000 12:48:11 -0700, in <#btnDt8q$GA.303@cpmsnbbsa04>, in sci.crypt "Joseph Ashwood" <ashwood@email.msn.com> wrote: >[...] >While I agree that the >breaking of an AES finalist in the next few years is >unlikely, We can believe whatever we want, but we simply have no evidence about the probability that a cipher may be broken, or when this might happen. There is no science to suggest that breaking an AES finalist in the next few years is "unlikely." Only wishing suggests that. >unbreakability against an infinite future is at >best laughable. Of course. --- Terry Ritter ritter@io.com http://www.io.com/~ritter/ Crypto Glossary http://www.io.com/~ritter/GLOSSARY.HTM
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 09:05:55 GMT From: Mike Kent <mkent@acm.org> Message-ID: <39016C83.B5D88237@acm.org> References: <39008864.6910045@news.io.com> Newsgroups: sci.crypt Lines: 37 Terry Ritter wrote: > > On Fri, 21 Apr 2000 16:41:57 GMT, in <390085B9.D5369DB0@dasoft.org>, > in sci.crypt Tom St Denis <tom@dasoft.org> wrote: > > >Mike Kent wrote: > >> > >> Tom St Denis wrote: > >> > >> > UBCHI2 wrote: > >> ... > >> > > Intractable math problem are only in the eye of the beholder. How many of you > >> > > would have thought that the enigma could be broken? > >> > > >> > This is amazingly false. > >> > >> Hmmm, it's _very probably_ amazingly false. > > > >I would like to think all the math-wizards know what they are doing. > >Ciphers along the same idea as DES (i.e feistel) have been around for a > >while. > > > >Of course it's entirely possible that all AES ciphers and pre-aes > >ciphers get broken tommorow. However, that is as likely as monkeys > >learning speech and taking over the world while we are asleep. > > True, the original claims were over the top, but this is way beyond > what we know in the other direction. We do not know the strength of > these ciphers. The designers and reviewers do not know the strength > of these ciphers. None of us *can* know strength with respect to > opponents we do not know and whose knowledge and resources we also do > not know. Hmm, I think we can, we just don't yet. When some bright person proves P != NP and we see NP-hard crypto, I think it will be fair to say this is strong, really.
Subject: Re: The Illusion of Security Date: Thu, 27 Apr 2000 13:28:05 -0700 From: Diet NSA <the_nsa@my-deja.com> Message-ID: <0048d094.95fedf60@usw-ex0101-005.remarq.com> References: <39016C83.B5D88237@acm.org> Newsgroups: sci.crypt Lines: 20 In article <39016C83.B5D88237@acm.org>, Mike Kent <mkent@acm.org> wrote: >Hmm, I think we can, we just don't yet. When some bright person >proves P != NP and we see NP-hard crypto, I think it will be >fair >to say this is strong, really. > > No one knows if P != NP can even be proven, so "when some bright person proves P != NP" may be never. Even if it were proven I don't see how such a proof would automatically lead to NP-hard crypto. (Note that all cryptosytems based on the knapsack problem, which is an NP-complete problem, have been shown to be insecure). " V hfdt afogx nfvw ufo axb (o)(o) " - Gtnjv ---------------------------------------------------- * Sent from RemarQ http://www.remarq.com The Internet's Discussion Network * The fastest and easiest way to search and participate in Usenet - Free!
Subject: Re: The Illusion of Security Date: 28 Apr 2000 04:23:35 GMT From: David A Molnar <dmolnar@fas.harvard.edu> Message-ID: <8eb3o7$o7v$1@news.fas.harvard.edu> References: <05f57a00.24cf191c@usw-ex0103-018.remarq.com> <8eaj7c$l5k$1@news.fas.harvard.edu> <0048d094.95fedf60@usw-ex0101-005.remarq.com> Newsgroups: sci.crypt Lines: 69 Diet NSA <the_nsa@my-deja.com> wrote: > In article < > 8eaj7c$l5k$1@news.fas.harvard.edu>, > David A Molnar <dmolnar@fas.harvard.edu> > wrote: >>It may not. > What may not? A proof that P != NP may indeed not lead to crypto based on NP-hard problems. Looking back that was phenomenally unclear. I'm sorry. > The question of whether true one-way > functions exist is related to the P/NP > question. You might want to read these 2 > websited sci.crypt posts by Reinhold > which argue that P/NP is not relevant for > crypto (and, BTW, presents an interesting > example taken from Bob Silverman about > the computability of a certain algorithm): > http://world.std.com/~reinhold/p=np.txt Thanks much for the link. It's interesting to see the points about average case complexity, constants hidden by O() (pointed out by Jay Sulzberger, no less), and whether a low-degree exponential is better than a high-degree polynomial. For one of my classes this term I'm looking at the average case complexity of the simplex method; one of the references by Papadimitriou and Steiglitz raises the first and last objections to the identification of "polynomial" with "tractable" in that context.. > AFAIK, this is true and that all knapsack > cryptosystems are susceptible to LLL > lattice reduction methods. What you have Interestingly enough, LLL is a high degree polynomial algorithm (O(n^4) or O(n^6) depending on whether you count arithmetic or bit operations). From what I can tell, there are at least some instances or challenges from lattice-based systems which are still secure because LLL is just too slow at the high dimensions (around 400+). > written above emphasizes my point which > was, in part, that even if one starts with > an NP-complete problem, such as the > knapsack problem, then one is not > guaranteed to be able to use this problem > as a basis for deriving a cryptosystem > which is, most of the time, NP-hard to > break. Yeah - I was taking issue with the what I thought was an implication that the knapsack cryptosystems were in fact NP-hard to break...which they aren't. Glad we agree. :-) > question is still open. I still don't see any > way that if one has a proof that P != NP > then one can automatically generate from > it NP-hard cryptosystems. Agreed. Although if the proof takes the form of a lower bound for some problem in NP - P, that might be good enough. Given the totally perverse nature of complexity theory, such a proof is unlikely...
Subject: Re: The Illusion of Security Date: Fri, 28 Apr 2000 14:00:53 GMT From: "Douglas A. Gwyn" <gwyn@arl.mil> Message-ID: <39099995.5B352089@arl.mil> References: <8eb3o7$o7v$1@news.fas.harvard.edu> Newsgroups: sci.crypt Lines: 14 David A Molnar wrote: > For one of my classes this term I'm looking at the average case > complexity of the simplex method; ... Danzig's simplex algorithm for solving LP problems has long been an interesting example of a heuristically-developed NP-class method that works much better in the real world than we seem to have any theoretical reason to expect, and it is of sufficient practical value (not having been displaced by the P-class ellipsoid algorithm) that it needs to be better understood. Determining "average" behavior is tricky, because it depends on the assumed distribution of input problems; I know of no realistic model for that (other than observing a carefully drawn representative sample of actual applications).
Subject: Re: The Illusion of Security Date: 30 Apr 2000 22:38:52 GMT From: David A Molnar <dmolnar@fas.harvard.edu> Message-ID: <8eicls$vji$1@news.fas.harvard.edu> References: <33e24b00.ce719225@usw-ex0104-087.remarq.com> <8eb3o7$o7v$1@news.fas.harvard.edu> Newsgroups: sci.crypt Lines: 30 Diet NSA <the_nsa@my-deja.com> wrote: > In article <8eb3o7$o7v$1@news.fas.harvard.edu>, David A Molnar > <dmolnar@fas.harvard.edu> wrote: >>arithmetic or bit operations). From what I can tell, there are >>at least some instances or challenges from lattice-based systems >>which are still secure because LLL is just too slow at the >>high dimensions (around 400+). > Do you happen to know anything more specific about this? (If you > don't have the time, I could look for references myself). Thanks. Look for Phong Nguyen and company's papers on breaking the GGH system and "A Converse to the Ajtai-Dwork Security Result." If you read through them, you'll see something in there about how they were able to break many of the challenge problems easily, but then ran into a little bit of trouble at extremely high dimensions and didn't have the spare CPU time to spend on doing LLL. The cryptosystems can still be considered "broken" because at those high dimensions they are so inefficient that there's no point to using them vs. RSA... Phong Nguyen's home page is at : http://www.di.ens.fr/~pnguyen/pub.html It looks like he's just published a survey paper on "Update on Lattices in Cryptology", so maybe that's the place to look for more discussion. Thanks, -David
Subject: Re: The Illusion of Security Date: Fri, 28 Apr 2000 13:50:40 GMT From: "Douglas A. Gwyn" <gwyn@arl.mil> Message-ID: <39099730.5A09E86@arl.mil> References: <05f57a00.24cf191c@usw-ex0103-018.remarq.com> <8eaj7c$l5k$1@news.fas.harvard.edu> <0048d094.95fedf60@usw-ex0101-005.remarq.com> Newsgroups: sci.crypt Lines: 20 Diet NSA wrote: > question. You might want to read these 2 > websited sci.crypt posts by Reinhold > which argue that P/NP is not relevant for > crypto ... I argued many years ago in this newsgroup that P?=NP was not relevant for cryptology, and was flamed so badly that I abandoned the newsgroup for several years. My basic point was that the classes P and NP refer *only* to behavior as the problem size N becomes *infinitely* large, which may be interesting abstractly but doesn't help with assessing actual systems. Much more relevant would be a theory of *finite complexity*, which for example would estimate the *fewest* number of cycles necessary to achieve a given computational task on a standard class of architectures. There of course have been studies in this area, but it doesn't seem to have produced a coherent general theory.
Subject: Re: The Illusion of Security Date: Mon, 1 May 2000 14:24:25 GMT From: "Douglas A. Gwyn" <gwyn@arl.mil> Message-ID: <390D9399.F4AAF6EA@arl.mil> References: <0080acb1.d24e3221@usw-ex0104-087.remarq.com> <39099730.5A09E86@arl.mil> Newsgroups: sci.crypt Lines: 9 Diet NSA wrote: > BTW, here's some advice for you or anyone else using discussion > groups: If you are flamed it may be best not to counter too > aggressively using your real identity. We don't want to > inadvertently encourage someone who might have criminal > intentions and/or be disturbed to act out- ... While that sounds paranoid, actually it isn't -- I did receive a death threat from one of the flamers in e-mail..
Subject: Re: The Illusion of Security Date: Fri, 28 Apr 2000 14:07:43 GMT From: "Douglas A. Gwyn" <gwyn@arl.mil> Message-ID: <39099B2F.BA4F2229@arl.mil> References: <3908E9A8.630FA050@acm.org> <0048d094.95fedf60@usw-ex0101-005.remarq.com> Newsgroups: sci.crypt Lines: 14 Mike Kent wrote: > ... a comment which I paraphrase as "you may find out that a > cipher is weak, but it's impossible ever to know if a cipher > is really strong". One should be careful of making such strong categorical claims. In one of Shannon's seminal papers, he already showed how one could place a lower bound on the secrecy of a simple system. It may well be that the open community hasn't followed up on that approach, but that doesn't mean that it couldn't be further developed. For example, Kullback's book proves that a certain statistic, readily computed in many cases, is the best one possible for testing a hypothesis. That can be used to establish lower bounds on secrecy of more elaborate systems.
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 16:03:48 GMT From: jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) Message-ID: <3901c5be.356140@news.ecn.ab.ca> References: <39008864.6910045@news.io.com> Newsgroups: sci.crypt Lines: 66 On Fri, 21 Apr 2000 16:57:30 GMT, ritter@io.com (Terry Ritter) wrote, in part: >True, the original claims were over the top, but this is way beyond >what we know in the other direction. We do not know the strength of >these ciphers. The designers and reviewers do not know the strength >of these ciphers. None of us *can* know strength with respect to >opponents we do not know and whose knowledge and resources we also do >not know. >There exists no basis for asserting that breaking these ciphers is >"unlikely." We have no testable probability distribution for the >breaking of ciphers. If the only thing we have to go on is the >limited published experience, we might well say that every algorithmic >cipher is likely to be broken eventually. And that is precisely the >opposite of your unproven assertion that breaking AES is unlikely. Well, it is true that the Enigma was broken, despite the fact that it seemed secure at the time. And the same might be said of CORAL. And it might be noted that the original LUCIFER, on which DES was based, does fall to differential cryptanalysis, and thus its 128-bit key isn't a guarantee of security. However, it is true that the general climate of opinion does seem to tilt in the direction that ciphers such as the five AES finalists are adequate. One basis for this might be that in the absence of any real knowledge about the strength of ciphers, we don't have a basis for assuming that breaking the AES (or Triple-DES, or Blowfish) will be "likely", either, and therefore the effort of using something stronger is hard to justify. If you were to respond that this is a silly place to put the burden of proof for anyone who is really concerned about security, I'm afraid I'd have to agree with you. Of course, many users of cryptography are concerned with Opponents who have very limited resources. If a bank wants to protect credit-card transactions, its concern is that it will use something generally recognized as secure, so that it cannot be found negligent: maybe they could make an even stronger cipher (or, worse, one they mistakenly think is even stronger) themselves, but perhaps even that could be broken, and in that latter case, they would be in a worse situation. Presumably, if an AES break were used for credit card fraud, word would get out before the losses were serious. The power and flexibility of the computer, and the new flurry of cryptography-related activity in academe, even if they don't prove anything, are seen by many as indicative that the rules may have changed: that 'this time', the ciphers believed to be secure won't fall by the wayside the way the Enigma did. My personal inclination in this matter is that this point of view has some validity, but if one is serious about security, taking a single block cipher "neat"; that is, using it all by itself in one of the standard DES modes that, except for solving some small problems, do not fundamentally increase security over ECB mode; ought to be avoided if one has the resources to do so. A little extra effort is worth doing, and enciphering a message by a sandwich such as DES/Panama/SAFER, even if I cannot prove cryptanalysis of it to be 'unlikely', at least would require a method of attack so very far beyond anything that is public knowledge that some degree of confidence is warranted. But I find that encouraging people to make even that little bit of extra effort seems to be quite difficult.
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 12:56:26 -0700 From: "Joseph Ashwood" <ashwood@email.msn.com> Message-ID: <ec44RXJr$GA.237@cpmsnbbsa03> References: <3901c5be.356140@news.ecn.ab.ca> Newsgroups: sci.crypt Lines: 29 > Presumably, if an AES break were used for credit card fraud, word > would get out before the losses were serious. How big do you consider serious? Let's face it, if someone is smart enough to break AES, they're gonna be smart enough to use that information deceptively. A simple methodology would be: Work. Break AES Pay for big fat connection. Gather card information Once big fat connection has been live for a couple months. Have gethered thousands of cards. Open thousands of overseas bank accounts. Post all the cards to alt.hacking (and wherever else might want them). Take advantage of all hell breaking loose at the banks to withdraw all the money you can (making use of big fat connection to do it very very fast). Route money into thousands of overseas bank accounts. trickle the money back in over the next 50 years. That would generate somewhere in the hundreds of billions of dollars in losses for credit companies. FDIC could go under, the entire US banking system would be shaken. I'd call that serious losses. It only takes a little patience. Of course I'd never do this, I'd come to sci.crypt ask for test vectors, and post solutions, giving word of the break before I announced details, it would be too critical. Joe
Subject: Re: The Illusion of Security Date: Sat, 29 Apr 2000 15:20:35 GMT From: Tim Tyler <tt@cryogen.com> Message-ID: <FtsAMB.28F@bath.ac.uk> References: <ec44RXJr$GA.237@cpmsnbbsa03> Newsgroups: sci.crypt Lines: 22 Joseph Ashwood <ashwood@email.msn.com> wrote: :> Presumably, if an AES break were used for credit card :> fraud, word would get out before the losses were serious. : : How big do you consider serious? Let's face it, if someone : is smart enough to break AES, they're gonna be smart enough : to use that information deceptively. [snip banking example] : Of course I'd never do this, I'd come to sci.crypt ask for test : vectors, and post solutions, giving word of the break before I : announced details, it would be too critical. If such a cypher were widely deployed - and then trivially broken - you may have to wait *years* before announcing details, in order to give everyone a fair chance to change their systems, if "serious losses" were to be avoided. -- __________ Lotus Artificial Life http://alife.co.uk/ tt@cryogen.com |im |yler The Mandala Centre http://mandala.co.uk/ Be good, do good. Summary: ref to Ross Anderson, "Why Cryptosystems Fail"
Subject: Re: The Illusion of Security Date: 25 Apr 2000 11:01:28 +0200 From: jthorn@mach.thp.univie.ac.at (Jonathan Thornburg) Message-ID: <8e3mt8$2ob$1@mach.thp.univie.ac.at> References: <3901c5be.356140@news.ecn.ab.ca> Newsgroups: sci.crypt Lines: 35 In article <3901c5be.356140@news.ecn.ab.ca>, John Savard <jsavard@tenMAPSONeerf.edmonton.ab.ca> wrote: [[ many interesting and cogent comments ]] I think people interested in this thread might find the article Ross Anderson "Why Cryptosystems Fail" Originally published in Proceedings of the First ACM Conference on Computer and Communications Security (11/93) pp 215 - 227 online at http://www.d.shuttle.de/isil/crypt/txt/wcf.html of great interest. I'll quote the abstract here: Designers of cryptographic systems are at a disadvantage to most other engineers, in that information on how their systems fail is hard to get: their major users have traditionally been government agencies, which are very secretive about their mistakes. In this article, we present the results of a survey of the failure modes of retail banking systems, which constitute the next largest application of cryptology. It turns out that the threat model commonly used by cryptosystem designers was wrong: most frauds were not caused by cryptanalysis or other technical attacks, but by implementation errors and management failures. This suggests that a paradigm shift is overdue in computer security; we look at some of the alternatives, and see some signs that this shift may be getting under way. Enjoy, -- -- Jonathan Thornburg <jthorn@galileo.thp.univie.ac.at> http://www.thp.univie.ac.at/~jthorn/home.html Universitaet Wien (Vienna, Austria) / Institut fuer Theoretische Physik Q: Which countries [only 5 of them] have the death penalty for children? A: Iran, Nigeria, Pakistan, Saudi Arabia, and United States
Subject: Re: The Illusion of Security Date: Sat, 22 Apr 2000 16:10:47 GMT From: jsavard@tenMAPSONeerf.edmonton.ab.ca (John Savard) Message-ID: <3901cecd.2676104@news.ecn.ab.ca> References: <20000421022421.18662.00005919@ng-cg1.aol.com> <8do6bt$1lp$1@bob.news.rcn.net> Newsgroups: sci.crypt Lines: 10 On 21 Apr 2000 06:24:21 GMT, ubchi2@aol.comnojunks (UBCHI2) wrote, in part: >He's probably right for the wrong reasons. Nothing but the one time pad has >ever worked in cryptography for any length of time. >Intractable math problem are only in the eye of the beholder. How many of you >would have thought that the enigma could be broken? Well, I'd like to see someone break SIGABA.
Subject: Re: The Illusion of Security Date: Tue, 25 Apr 2000 14:09:15 -0700 From: "Joseph Ashwood" <ashwood@email.msn.com> Message-ID: <OLZ4esvr$GA.260@cpmsnbbsa04> References: <j824e8.1lf.ln@twirl> <38FF7BA3.67D49612@dasoft.org> Newsgroups: sci.crypt Lines: 33 The solution used most typically is to use two (or more) linear functions, but verfiy that they are linear in different spaces, for example addition and exclusive-or, as in Blowfish. This makes for something fairly non-linear, and if chosen correctly, almost completely non-linear. Of course if someone successfully extends algebra, and a few others, to XOR and addition at the same time (I'm working on it), many forms of encryption will have to be retired. Many other algorithms will also have severe hits on their security. Joe "Geoff Lane" <zzassgl@twirl.mcc.ac.uk> wrote in message news:j824e8.1lf.ln@twirl... > >> The secret lies in the Non Linear F Function...This can be decomposed > >> into Algebraic Linear Primitives...and the Key can be recovered > >> relatively easily...The Backdoor Function... > > Err..., can a non-linear function be composed of a finite number of linear > functions? Fourier analysis would imply not. Unfortunately an approximate > solution will not result in a valid decrypt. > > > -- > /\ Geoff. Lane. /\ Manchester Computing /\ Manchester /\ M13 9PL /\ England /\ > > Today's Excuse: The keyboard isn't plugged in
Subject: Re: The Illusion of Security Date: Tue, 25 Apr 2000 23:03:01 -0700 From: "Simon Johnson" <Pabalo@Dimension.h3o.org> Message-ID: <8e54fv$c7u$1@plutonium.btinternet.com> References: <38FF7BA3.67D49612@dasoft.org> <8dnjit$3eh$1@nnrp1.deja.com> Newsgroups: sci.crypt Lines: 23 I think we over-estimate the NSA. They may have super-fast computers and large budgets but the 'hampsters' that work there are still human. People don't suddenly grow larger brains when they join the NSA. So no matter how much money you throw at a problem, it doesn't make that problem any easier to solve (by that i mean the mathematical not the computational difficulty). Secondly, I take the view that cryptography offers the greatest security to the greatest number of people. I'm not really bothered about wether 'hampster' boy in the NSA can break Two-Fish, what matters is that my coporate sponsered cracking is never feasible. Thirdly, Its total rubbish to say that a cipher can never be proved secure, the one time pad is a provenly secure cipher. But that not really my point, It was proven secure mathematically. If your willing to throw out all the mathematical proof that a cipher is secure because some quicker method _might_ exist then you're really very stupid. Its like saying that the square root of two isn't irrational because you can't directly prove it is, and we know that's rubbish. -- Hi! I'm a signature virus! Copy me into your signature file to help me spread!
Subject: Re: The Illusion of Security Date: Tue, 25 Apr 2000 22:20:32 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <39061B20.7A050119@dasoft.org> References: <8e54fv$c7u$1@plutonium.btinternet.com> Newsgroups: sci.crypt Lines: 34 Simon Johnson wrote: > > I think we over-estimate the NSA. They may have super-fast computers and > large budgets but the 'hampsters' that work there are still human. People > don't suddenly grow larger brains when they join the NSA. So no matter how > much money you throw at a problem, it doesn't make that problem any easier > to solve (by that i mean the mathematical not the computational difficulty). > Secondly, I take the view that cryptography offers the greatest security > to the greatest number of people. I'm not really bothered about wether > 'hampster' boy in the NSA can break Two-Fish, what matters is that my > coporate sponsered cracking is never feasible. > Thirdly, Its total rubbish to say that a cipher can never be proved > secure, the one time pad is a provenly secure cipher. But that not really my > point, It was proven secure mathematically. If your willing to throw out all > the mathematical proof that a cipher is secure because some quicker method > _might_ exist then you're really very stupid. Its like saying that the > square root of two isn't irrational because you can't directly prove it is, > and we know that's rubbish. > -- > Hi! I'm a signature virus! Copy me into your signature file to help me > spread! I second the motion. Question been called, passed. Common sense is allowed back into sci.crypt. I agree whole heartedly with ya :) Tom -- Want your academic website listed on a free websearch engine? Then please check out http://24.42.86.123/search.html, it's entirely free and there are no advertisements.
Subject: Re: The Illusion of Security Date: Tue, 25 Apr 2000 16:42:28 -0700 From: "Joseph Ashwood" <ashwood@email.msn.com> Message-ID: <Oc9WaAxr$GA.361@cpmsnbbsa04> References: <8e54fv$c7u$1@plutonium.btinternet.com> Newsgroups: sci.crypt Lines: 16 > Thirdly, Its total rubbish to say that a cipher can never be proved > secure, the one time pad is a provenly secure cipher. But that not really my > point, It was proven secure mathematically. The problem being of course that it is a strictly theoratical proof, requiring proof that the stream consists of pure randomness, which was noted as being unprovable. Invalidating any relevance of OTP in the real world, since we are discussing real world security, there is no proof of security available that does not require assumptions that can be forced to be untrue. Joe
Subject: Re: The Illusion of Security Date: Mon, 8 May 2000 13:59:39 GMT From: Tim Tyler <tt@cryogen.com> Message-ID: <Fu8uvE.2FJ@bath.ac.uk> References: <390654A1.23174CA1@dasoft.org> <Oc9WaAxr$GA.361@cpmsnbbsa04> Newsgroups: sci.crypt Lines: 34 Tom St Denis <tom@dasoft.org> wrote: : Joseph Ashwood wrote: :> > Thirdly, Its total rubbish to say that a cipher can :> > never be proved secure, the one time pad is a provenly :> > secure cipher. But that not really my :> > point, It was proven secure mathematically. :> The problem being of course that it is a strictly :> theoratical proof, requiring proof that the stream consists :> of pure randomness, which was noted as being unprovable. :> Invalidating any relevance of OTP in the real world, since :> we are discussing real world security, there is no proof of :> security available that does not require assumptions that :> can be forced to be untrue. : We have alot of theory to prove things are not random, likewise they can : suggest when something isn't. [...] You probably meant to say "suggest when something *is*". Unfortunalely, secptics are not terribly suggestible. They typically require some sort of demonstration before they will accept a proposition. Inability to detect deviations from randomness using statistical tests doesn't say very much. Look at the way "Diehard" gets taken in by the "KISS" RNG that comes with it, for example. Our ability to produce randomness probably far exceeds our ability to test for it. Failure to detect non-randomness does not a proof of randomness make. -- __________ Lotus Artificial Life http://alife.co.uk/ tt@cryogen.com |im |yler The Mandala Centre http://mandala.co.uk/ Be good, do good.
Subject: Re: The Illusion of Security Date: Mon, 8 May 2000 13:52:32 GMT From: Tim Tyler <tt@cryogen.com> Message-ID: <Fu8uJK.vv@bath.ac.uk> References: <8e54fv$c7u$1@plutonium.btinternet.com> Newsgroups: sci.crypt Lines: 18 Simon Johnson <Pabalo@dimension.h3o.org> wrote: : Thirdly, Its total rubbish to say that a cipher can never be proved : secure, the one time pad is a provenly secure cipher. Not so. The OTP is proven secure against eavsdropping *IF* a secure source of random numbers can be provided. The difficulty in locating a demonstrably random source is the cause of the problems. Of course in practice, there are many other security problems with the OTP, involving things like secure key-distribution, and the fact that known-plaintext attacks expose the key, allowing the possibility of spoofing messages. -- __________ Lotus Artificial Life http://alife.co.uk/ tt@cryogen.com |im |yler The Mandala Centre http://mandala.co.uk/ Be good, do good.
Subject: Re: The Illusion of Security Date: Sun, 30 Apr 2000 20:10:31 -0700 From: Diet NSA <the_nsa@my-deja.com> Message-ID: <1194d83c.627637f7@usw-ex0105-035.remarq.com> References: <e41oOeOr$GA.234@cpmsnbbsa03> <39026D32.1BDDFCEB@wavewizard.com> Newsgroups: sci.crypt Lines: 39 In article < e41oOeOr$GA.234@cpmsnbbsa03>, "Joseph Ashwood" <ashwood@email.msn.com> wrote: Without a proof of >randomness, the proof of OTP is invalid, without the proof >of OTP the security there is no proof of security available. >If I am wrong, please give a reference. You might want to read D. Gwyn's reply in the "Claims/Science Daily" thread and also why physicists consider certain quantum phenomena to be "random", physically speaking. > >There are also more instances where quantum computing is >simply inapplicable, then there are ones where it is >applicable. Why is this? > >This is not a questioning of you, it is a comment on the >astounding amount of misinformation that has abounded about >quantum cryptography. By whom? " V hfdt afogx nfvw ufo axb (o)(o) " - Gtnjv ---------------------------------------------------- * Sent from RemarQ http://www.remarq.com The Internet's Discussion Network * The fastest and easiest way to search and participate in Usenet - Free!
Subject: Re: The Illusion of Security Date: Fri, 5 May 2000 00:01:03 GMT From: Tim Tyler <tt@cryogen.com> Message-ID: <Fu281q.1v2@bath.ac.uk> References: <1194d83c.627637f7@usw-ex0105-035.remarq.com> Newsgroups: sci.crypt Lines: 30 Diet NSA <the_nsa@my-deja.com> wrote: : "Joseph Ashwood" <ashwood@email.msn.com> wrote: :>Without a proof of randomness, the proof of OTP is invalid, without the :>proof of OTP the security there is no proof of security available. :>If I am wrong, please give a reference. : You might want to read D. Gwyn's reply in : the "Claims/Science Daily" thread and : also why physicists consider certain : quantum phenomena to be "random", : physically speaking. Regardless of the randomness or otherwise of quantum phenomena, there's still no sign of a proof that there exists a usable source of randomness with provably secure properties for use as an OTP. For one thing, you can't rule out the possibility that your equipment for amplifying the signal from the quantum domain is not under your opponent's influence in any way. Also, as a physical device it will inevitably be influenced by its immediate enviroment - which necessarily includes non-random signals, such as cosmic ray particles. A proof of security that would satisfy a hardened sceptic appears to be inconceivable. -- __________ Lotus Artificial Life http://alife.co.uk/ tt@cryogen.com |im |yler The Mandala Centre http://mandala.co.uk/ UART what UEAT.
Subject: Re: The Illusion of Security Date: Sun, 7 May 2000 15:12:25 GMT From: Tim Tyler <tt@cryogen.com> Message-ID: <Fu73Kp.Gs6@bath.ac.uk> References: <09ea1b64.4c15a3ef@usw-ex0107-055.remarq.com> <Fu281q.1v2@bath.ac.uk> Newsgroups: sci.crypt Lines: 19 Diet NSA <the_nsa@my-deja.com> wrote: : In article <Fu281q.1v2@bath.ac.uk>, Tim Tyler <tt@cryogen.com> wrote: :> A proof of security that would satisfy a hardened sceptic :> appears to be inconceivable. : There may not be a proof in an affirmative sense, but would a : hardened sceptic be satisfied if, practically speaking, we could : render the statistical analysis of encrypted data useless? [...] If you could demonstrate that statistical analysis will /always/ be useless, yes - but how could you go about doing that? I don't see why a sceptic should be convinced by observing someone trying all they types of statistical analysis they happened to know and failing to locate a pattern. -- __________ Lotus Artificial Life http://alife.co.uk/ tt@cryogen.com |im |yler The Mandala Centre http://mandala.co.uk/ Be good, do good.
Subject: Re: The Illusion of Security Date: Mon, 8 May 2000 12:33:01 GMT From: Tim Tyler <tt@cryogen.com> Message-ID: <Fu8qv1.6G6@bath.ac.uk> References: <0bf07aa2.6e11c444@usw-ex0101-005.remarq.com> <Fu73Kp.Gs6@bath.ac.uk> Newsgroups: sci.crypt Lines: 32 Diet NSA <the_nsa@my-deja.com> wrote: : Tim Tyler <tt@cryogen.com> wrote: :>If you could demonstrate that statistical analysis will /always/ :> be useless, yes - but how could you go about doing that? :> :>I don't see why a sceptic should be convinced by observing :>someone trying all they types of statistical analysis they happened :>to know and failing to locate a pattern. : What you are saying may be true in an absolute sense which is why : I qualified my remarks with the phrases "practically speaking" : and "under current knowledge". According to *known* Quantum : Mechanics and regarding entangled photon crypto, the individual : photons have no polarization prior to measurement and the outcome : of each measurement is random. Assuming that I grant this, this still does not necessarily help in building a pad of random numbers for use with a one-time pad. No measuring process is able to operate completely independent of its environment - which may introduce biases into the results. Also, there's still a gap between the random phenomena and the encryption where an active opponent may have inserted some equipment of his own. I'm not disputing that you can get a probably-random looking stream for cryptographic purposes in practice. The notion I'm objecting to is that you can provide a watertight security "proof" for the results. -- __________ Lotus Artificial Life http://alife.co.uk/ tt@cryogen.com |im |yler The Mandala Centre http://mandala.co.uk/ Be good, do good.
Subject: Re: The Illusion of Security Date: Tue, 9 May 2000 12:51:50 GMT From: Tim Tyler <tt@cryogen.com> Message-ID: <FuAMEE.6qv@bath.ac.uk> References: <3917B282.E8E5D0ED@home.com> <Fu8u38.LtH@bath.ac.uk> Newsgroups: sci.crypt Lines: 29 Douglas A. Gwyn <dagwyn@home.com> wrote: : Tim Tyler wrote: :> In short the security "proof" for quantum cryptography appears to depend :> on the security of a random number generator - and it is this which I am :> calling into question in the first place. : No, the quantum system itself provides the randomness directly in : the (tamperproof) key stream. This does not appear to be the case in descriptions of quantum cryptography protocols with which I am familiar. As an example, it does not appear to be the case with the protocol as described by Schneier in "Applied Cryptography, p. 554-557. There the source of the randomness appears to be the way in which Alice sets up her polarised photon production devices - and /not/ any quantum events. Quantum events affect some of Bob's measurements - but these are the ones which are eventually discarded. If perhaps you are discussing another protocol from the ones I have encountered to date, then a description of such a protocol, or a pointer to such a description might help me to review the situation. -- __________ Lotus Artificial Life http://alife.co.uk/ tt@cryogen.com |im |yler The Mandala Centre http://mandala.co.uk/ Be good, do good.
Subject: Re: The Illusion of Security Date: Sun, 30 Apr 2000 20:45:30 -0700 From: Diet NSA <the_nsa@my-deja.com> Message-ID: <0d3ae957.6b9672b1@usw-ex0105-035.remarq.com> References: <j824e8.1lf.ln@twirl> <38FF7BA3.67D49612@dasoft.org> Newsgroups: sci.crypt Lines: 25 In article <j824e8.1lf.ln@twirl>, zzassgl@twirl.mcc.ac.uk (Geoff Lane) wrote: >Err..., can a non-linear function be composed of a finite number of linear >functions? Fourier analysis would imply not. Fourier methods won't apply to nonlinear problems because there cannot be any superposition of solutions. The requirement for superposition also means that fourier methods won't apply to linear systems either, *if* these sytems are not homogonous. Right now, I can't think of an (exact) answer to your question but I wish I knew the answer. " V hfdt afogx nfvw ufo axb (o)(o) " - Gtnjv ---------------------------------------------------- * Sent from RemarQ http://www.remarq.com The Internet's Discussion Network * The fastest and easiest way to search and participate in Usenet - Free!
Subject: Re: The Illusion of Security Date: Mon, 1 May 2000 14:34:05 GMT From: "Douglas A. Gwyn" <gwyn@arl.mil> Message-ID: <390D95DD.E3DB2175@arl.mil> References: <0d3ae957.6b9672b1@usw-ex0105-035.remarq.com> Newsgroups: sci.crypt Lines: 30 Diet NSA wrote: > In article <j824e8.1lf.ln@twirl>, > zzassgl@twirl.mcc.ac.uk (Geoff Lane) > wrote: > >Err..., can a non-linear function be composed of a finite > number of linear > >functions? Fourier analysis would imply not. For cryptosystem construction, it is probably the basic *binary* operators that should be considered "linear" or not (for this thread), not *unary* functions, which is the more usual meaning. Without careful clarification of what is meant by "linear" and "composition", time will be wasted in arguing at cross-purposes. > Fourier methods won't apply to nonlinear > problems because there cannot be any > superposition of solutions. The > requirement for superposition also means > that fourier methods won't apply to linear > systems either, *if* these sytems are not > homogonous. Right now, I can't think of an > (exact) answer to your question but I > wish I knew the answer. Fourier analysis certainly *can* be employed productively against (some) nonlinear systems. For example, nonlinear systems can be periodic or quasi-periodic, and Fourier methods can determine the period.
Subject: Re: The Illusion of Security Date: Mon, 01 May 2000 14:26:45 -0700 From: Diet NSA <the_nsa@my-deja.com> Message-ID: <2ad6a3cf.ac2b32f7@usw-ex0101-005.remarq.com> References: <390D95DD.E3DB2175@arl.mil> Newsgroups: sci.crypt Lines: 33 In article <390D95DD.E3DB2175@arl.mil>, "Douglas A. Gwyn" <gwyn@arl.mil> wrote: >For cryptosystem construction, it is probably the basic >*binary* operators that should be considered "linear" or >not (for this thread), not *unary* functions, which is >the more usual meaning. Without careful clarification >of what is meant by "linear" and "composition", time will >be wasted in arguing at cross-purposes. This is a good point but I was hoping that someone might know of a proof or disproof of whether, in the general case, a nonlinear function can be composed of a finite number of linear functions. >Fourier analysis certainly *can* be employed >productively against (some) nonlinear systems. >For example, nonlinear systems can be periodic >or quasi-periodic, and Fourier methods can >determine the period. > This may be true but I was implying what the original poster might have been thinking- In general, Fourier methods are not useful for solving nonlinear problems because these problems are not susceptible to superposition of solutions. " V hfdt afogx nfvw ufo axb (o)(o) " - Gtnjv ---------------------------------------------------- * Sent from RemarQ http://www.remarq.com The Internet's Discussion Network * The fastest and easiest way to search and participate in Usenet - Free!
Subject: Re: The Illusion of Security Date: Tue, 02 May 2000 05:37:15 GMT From: Mike Kent <mkent@acm.org> Message-ID: <390E6AA6.79985520@acm.org> References: <2ad6a3cf.ac2b32f7@usw-ex0101-005.remarq.com> Newsgroups: sci.crypt Lines: 15 Diet NSA wrote: > This is a good point but I was hoping that someone might know of > a proof or disproof of whether, in the general case, a nonlinear > function can be composed of a finite number of linear functions. Can a nonlinear function (in this context) be composed from *two* linear functions? If not, that is if for your combining method "#", f#g is linear whenever f, g are linear, then f#(g#h) and (f#g)#h are linear for linear f,g,h and a straightforward induction establishes the linearity for any finite combination.
Subject: Re: The Illusion of Security Date: Tue, 02 May 2000 11:33:38 GMT From: Tom St Denis <tom@dasoft.org> Message-ID: <390EBE18.39C8CCA6@dasoft.org> References: <390E6AA6.79985520@acm.org> Newsgroups: sci.crypt Lines: 44 Mike Kent wrote: > > Diet NSA wrote: > > > This is a good point but I was hoping that someone might know of > > a proof or disproof of whether, in the general case, a nonlinear > > function can be composed of a finite number of linear functions. > > Can a nonlinear function (in this context) be composed from > *two* > linear functions? If not, that is if for your combining method > "#", > f#g is linear whenever f, g are linear, then f#(g#h) and (f#g)#h > are > linear for linear f,g,h and a straightforward induction > establishes > the linearity for any finite combination. No because you simply get a linear function out. For example: F(x) = 2x + 1 G(x) = 7x - 5 F o G = F(7x - 5) = 2(7x - 5) + 1 = 14x - 9 You have to create the function normally from a table. However you can make non-linear functions from higher order equations such as F(x) = 45^x mod 257 Tom -- Want your academic website listed on a free websearch engine? Then please check out http://tomstdenis.n3.net/search.html, it's entirely free and there are no advertisements.
Subject: Re: The Illusion of Security Date: Wed, 03 May 2000 08:16:47 GMT From: "Douglas A. Gwyn" <DAGwyn@null.net> Message-ID: <390FE06F.1470B68F@null.net> References: <2ad6a3cf.ac2b32f7@usw-ex0101-005.remarq.com> Newsgroups: sci.crypt Lines: 22 Diet NSA wrote: > In article <390D95DD.E3DB2175@arl.mil>, "Douglas A. Gwyn" > <gwyn@arl.mil> wrote: > >For cryptosystem construction, it is probably the basic > >*binary* operators that should be considered "linear" or > >not (for this thread), not *unary* functions, which is > >the more usual meaning. Without careful clarification > >of what is meant by "linear" and "composition", time will > >be wasted in arguing at cross-purposes. > This is a good point but I was hoping that someone might know of > a proof or disproof of whether, in the general case, a nonlinear > function can be composed of a finite number of linear functions. Sure, and it illustrates my previous point: L(x) = x is linear, in the usual sense. L(x)*L(x) is a "composition" in one sense, and is nonlinear in the usual sense. If by linear you mean "linear transformation" and by composition you mean "successive transformations" then obviously any composition of linears is linear.
Terry Ritter, his current address, and his top page.
Last updated: 2001-06-24