NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/sci/crypt/6727

Internet Message Format | 1993-01-09 | 4.9 KB

Xref: sparky sci.crypt:6727 alt.security.pgp:492
Newsgroups: sci.crypt,alt.security.pgp
Path: sparky!uunet!elroy.jpl.nasa.gov!swrinde!emory!rsiatl!jgd
From: [e-mail] (John De Armond)
Subject: Re: Zimmermann's responses to Sidelnikov's PGP critique
Message-ID: <![e-mail]>
Date: Tue, 12 Jan 93 22:50:51 GMT
Organization: Dixie Communications Public Access.  The Mouth of the South.
References: <[e-mail]>
Lines: 84

[e-mail] (David Sternlight) writes:

>In response to Castor Fu, who has gone to some trouble to id
>Sidelnikov, as I've said in my e-mail to him (dunno if I've posted
>this or not), I received e-mail from a Russian at one of the most
>reputable U.S. Universities whose bona fides seem genuine, who says he
>knows Sidelnikov, has met him in Moscow, and he is who he says he is.

>Whether the Sidelnikov message is a spoof or not isn't known, but the
>history of its posting (first to an internal Russian network, then
>forwarded by a Latvian to us) seems to suggest Sidelnikov's bona fides
>had ample opportunity to be questioned in Russia and Latvia, and
>apparently were not.

>Unless you think the Latvian poster made it all up.

>Well, there's no point in arguing about it--the warning is there and
>may be ignored, accepted, or used as a tip to attempt independent
>verification of the claims.

Dave, do you see that little glow in the corner of your eye?  That's
your credibility dissipation light glowing brightly.  (to steal from
some movie or the other.)  Your unrestrained and illogical campaigning
for PKP is now costing you credibility on an issue people should be
paying attention to.

My contacts with ex-soviet nuclear colleagues also indicates Dr. Sidelnilov
is who he says he is.  I have sent old-fashioned paper mail to someone
in Russia who will absolutely confirm or deny Dr. Sidelnilov's credentials
but the answer will likely come too late for this debate.  As to the
claim that if Dr. Sidelnilov was part of the old Soviet government, he
would not be talking, that is complete rubbish.  As a nuke who is active
on the net and who helped through private channels during Chernobyl,
I have been contacted by people in the ex-Soviet weapons programs who I only
knew by reputation in the literature, offering just about anything I
wanted in return for money and/or US employment.  Anyone who thinks high
level military information from the ex-SU is not available to just about
anyone is fooling themselves.  It feels strange to be able to know more
about Soviet atomic weapons than I do about my own country's.

My position on PGP and the private use of crypto technology should be
quite clear to the reader from my past sparring with Sternglass and
ilk.  Nontheless, the display of kneejerking I've read in this
thread has been most dismaying.  Dr. Sidelnilov has been attacked for
for the imperfect English translation, for criticizing the sacred PGP,
for not entering into a debate in this forum even though it was quite
clear that the posting was a translation from a local SU net and various
and sundry other items.

What I have NOT read is anyone taking his analysis and trying to confirm
or deny its validity.  The messenger has been attacked but not the
message.  Is this really what science had degenerated to?  Namecalling?
Where is the philosophy that any crypto system should be suspected
until exhaustively proven secure in the state of the art environment
that exists at the moment?  Is the thought of sticking it in the eye
of the NSA, PKP and Commerce Department so overwhelmingly appealing
that all consideration of PGP's weaknesses are buried?  For that matter,
how do we know for sure that IDEA or even PGP itself is not a flawed
product of the intelligence community, planted as an underground product
to ensure its use by those most likely to do something of interest
by the government?  Saying you know Zimmerman or whomever does not
count, of course.  If one is going to use crypto for something where
it really matters that the materials be kept secret, one must
address these questions.

I'm not a crypto expert and so must rely on others who are for the analysis
of PGP and other schemes.  My reading of Dr Sidelnilov's analysis is
that what he says is reasonable.  Whether it is correct or not must
come from someone else, someone who I hope will forget the personal
attacks and analyze the problem. At this point what he says makes
AT LEAST as much sense as the so-far unsubstantiated claims that NSA
weakened DES intentionally.

Could we for a moment quit worrying about credentials and take a look
at the issue?

Thanks,
John
--
John De Armond, WD4OQC               |Interested in high performance mobility?
Performance Engineering Magazine(TM) | Interested in high tech and computers?
Marietta, Ga                         | Send ur snail-mail address to
[e-mail]                        | [e-mail] for a free sample mag
Need Usenet public Access in Atlanta?  Write Me for info on Dixie.com.