NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/sci/crypt/5152

Text File | 1992-11-21 | 3.1 KB | 67 lines

Newsgroups: sci.crypt
Path: sparky!uunet!spool.mu.edu!uwm.edu!linac!att!news.cs.indiana.edu!nstn.ns.ca!cs.dal.ca!ug.cs.dal.ca!gauthier
From: [e-mail] (Paul Gauthier)
Subject: Re: New ENcryption - a Challenge
Message-ID: <[e-mail]>
Sender: [e-mail] (USENET News)
Nntp-Posting-Host: ug2.cs.dal.ca
Organization: Math, Stats & CS, Dalhousie University, Halifax, NS, Canada
References: <[e-mail]>
Date: Sat, 21 Nov 1992 17:17:16 GMT
Lines: 54

In sci.crypt [e-mail] writes:

>Writes [e-mail] (Marc Thibault):
>
> > For an encryption to present a challenge, it has to be robust
> > under plaintext attack when the attacker has a copy of the
> > mechanism.
>
> Spoken _ex cathedra_.  I think an encryption might be extremely
> easy or extremely difficult to break whether one has a "copy of
> the mechanism" or whether one doesn't. In the real world, during
> a practical attempt at breaking a code, you might not have the
> algorithm.
>

I think what he, and a thousand other posters on the net, was trying
to say was that no one, in the real world, with real data to encrypt
is going to trust a system which hasn't been shown to resist a known
algorithm, known plaintext attack.

It is utterly naive to assume that this magic algorithm won't become
known to any sort of serious attacker. If more than a handful of people
ever come to use your algorithm, then surely through analysis of the
executable code and decompilation the algorithm _will_ become known
to all and sundry.

When you started this challenge did you read the FAQ? I'm guessing
that you did, and then decided to ignore, nay invert, all the good
advice contained therein and make this challenge. Enough with the damn
bandwidth wasting, the patronizing tones and the relentless repetitive
ranting, and on with the damn challenge.

Just be warned, even if the code is not broken, it shows nothing useful
about its utility as an encryption tool. Without analysis of the algorithm,
no one can know for sure how secure it may be. There could be a trivial
loophole which is made totally, and blatently obvious by a casual analysis
of the algorithm. In other words, this test can only show that your
method is useless, and can make _no_ statement concerning the fact that
it is useful. At some point you _will_ have to release the source code/
algorithm to gain some insight into its real utility. Why not just do it
now and stop this silly hand-waving, snotty-nosed, we-know-better-than-
all-you-professional-cryptographers, if-you-won't-take-our-challenge-as-
is-then-you-are-a-wimp-and-our-algorithm-must-scare-you-cause-it's-so-
damn-good, I'll-respond-to-everyone's-thoughtful-intelligent-postings-
by-ignoring-the-meat-and-flashing-back-some-rhetoric-bullshit-concerning-
a-peripheral-point waste of time?

PG

--
===========================================================================
                             Paul Gauthier
cyclist, rock climber, skydiver, computer scientist (...in order of danger)
Electronic: [e-mail]  Voice: [phone]  Fax: [phone]