Re: Standard for Stenography?

Sergey writes:
> I have often heard it said that one should always assume that one's 
> opponent knows everything except one's secret key.  To me, this makes no 
> sense!  If your opponent is good enough and determined enough to get by 
> all the layers of obscurity you may have put up, than its just one more 
> step to getting your secret key.

If your cryptography methods are good enough to withstand an
opponent who has full documentation of your algorithms and methods,
lots of funds, and everything except your keys, then you don't
need to waste your time with all the other stuff.  And if you can't
protect a couple of keys, it doesn't really matter how much other
security you have.

On the other hand, steganography is almost by definition an obscurity
technique, and while security-by-obscurity is a naive waste of time,
obscurity-by-obscurity is hard to argue against real clearly :-)
On the other hand, if your cyphertext looks like random bits anyway,
it doesn't take a lot to make them invisible.

The real need is to make your data look like Somebody Else's Problem....

			Bill

Sergey Goldgaber writes:
 > I have never heard a serious, reputable claim about the unbreakablity of 
 > an algorithm. 

Maybe not, but if you've been paying atention you know of a great deal
of theory that support the intractability of solving certain problems
in realistic amounts of time.  Most PK cryptosystems are based on
relatively simple principles of mathematics.  It stretches the
imagination to think that the NSA somehow has solved the factoring
problem; I concede it's possible, but unlikely.

 > The point is, that in the real world, we'll never know if our algorithms 
 > are "good enough to withstand an opponent who has full documentation of 
 > your algorithms and methods lots of funds, and everything except your keys."

Depends on what you mean by "know", I guess.

 > > security-by-obscurity is a naive waste of time,
 > 
 > I still don't see why.

Well, you can't tell when you've been compromised, and you have no
rigorous way of demonstrating the robustness of your obscurity.  The
real problem, however, is that you'll have a hard time convincing
anybody else to participate.

You can hide all your valuables in a really clever place and do all
sorts of really clever secret things to protect them, and that may
make you feel secure.  However, you won't be able to convince me to
entrust *my* valuables to you unless you explain to me the details of
your techniques.

--
| GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5@tivoli.com>       |
| TAKE TWA TO CAIRO.          ||| Tivoli Systems, Austin, TX:        |
|     (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

On Fri, 4 Mar 1994, Mike McNally wrote:

> Maybe not, but if you've been paying atention you know of a great deal
> of theory that support the intractability of solving certain problems
> in realistic amounts of time.  Most PK cryptosystems are based on
> relatively simple principles of mathematics.  It stretches the
> imagination to think that the NSA somehow has solved the factoring
> problem; I concede it's possible, but unlikely.

Granted.

> 
>  > The point is, that in the real world, we'll never know if our algorithms 
>  > are "good enough to withstand an opponent who has full documentation of 
>  > your algorithms and methods lots of funds, and everything except your keys."
> 
> Depends on what you mean by "know", I guess.

know = 100% objective certainty

> 
>  > > security-by-obscurity is a naive waste of time,
>  > 
>  > I still don't see why.
> 
> Well, you can't tell when you've been compromised, 

How can you tell that you've been compromised if you stick to 
non-security-by-obscurity methods?

> and you have no
> rigorous way of demonstrating the robustness of your obscurity.

That would be difficult.  But, lack of objective measures does not mean 
that security-through-obscurity is innefective.  BTW, there may be some 
statistics on the effectiveness of StO, somewhere.  (Anyone out there 
heard of any?)

> The real problem, however, is that you'll have a hard time convincing
> anybody else to participate.

I am not trying to convince everyone hide their data in the same place I 
am hiding it.  Simply consider hiding it, rather than leaving it out in 
the open!  That's not too crazy a proposition, is it?


> You can hide all your valuables in a really clever place and do all
> sorts of really clever secret things to protect them, and that may
> make you feel secure.  However, you won't be able to convince me to
> entrust *my* valuables to you unless you explain to me the details of
> your techniques.

Take your encrypted data.  Stick it in a file, using a variable offset.
That's all there is to it.



Sergey

> know = 100% objective certainty

Well, OTP gives you this.  Probabilistic encryption does too, I
think (the original version -- not the practical version).  Quantum
cryptography is pretty close, depending on how much trust you place
in the laws of physics.  Granted, none of these are very useful.

The question is, 100% objective certainty of *what*?  If breaking a
scheme were provably exponential-time, that'd be enough for me.

> Sergey

   Eli   ebrandt@hmc.edu

On Fri, 4 Mar 1994, Eli Brandt wrote:

> > know = 100% objective certainty
> 
> Well, OTP gives you this.  Probabilistic encryption does too, I
> think (the original version -- not the practical version).  Quantum
> cryptography is pretty close, depending on how much trust you place
> in the laws of physics.  Granted, none of these are very useful.
> 

Newbie questions:  What is OTP?  What about probabilistic encryption
                   vs quantum cryptography?

How do they give one 100% certainty that they can't be broken?

> The question is, 100% objective certainty of *what*?  If breaking a
> scheme were provably exponential-time, that'd be enough for me.
> 

100% objective certainty of the scheme's invulnerability.

> > Sergey
> 
>    Eli   ebrandt@hmc.edu
> 
> 

Sergey :)

> Newbie questions:  What is OTP?  What about probabilistic encryption
>                    vs quantum cryptography?

OTP is one-time pad.  There was an article on quantum cryptography
in the October '92 Scientific American.  For probabilistic encryption,
I think the sci.crypt FAQ has a reference.

> How do they give one 100% certainty that they can't be broken?

OTP and some flavors of probabilistic encryption are information-
theoretically secure.  For OTP, this is obvious if you think about
it a bit.  Quantum cryptography relies on the math of quantum mechanics,
whose validity is ultimately empirical but rather well tested.

> 100% objective certainty of the scheme's invulnerability.

My point is, invulnerability to *what attack*?  An attacker may know
the algorithm, or not; may have known plaintext; may be able to
choose plaintext; may be able to read a channel, or to garble it, or
to change it; may have limited or unlimited space and time; might be
able to factor in polynomial time -- there are a lot of parameters
here.  And it makes no sense at all to say, "Well, let's just
consider the strongest possible attack."

   Eli

On Sat, 5 Mar 1994, Eli Brandt wrote:
 
> My point is, invulnerability to *what attack*?  An attacker may know
> the algorithm, or not; may have known plaintext; may be able to
> choose plaintext; may be able to read a channel, or to garble it, or
> to change it; may have limited or unlimited space and time; might be
> able to factor in polynomial time -- there are a lot of parameters
> here.  And it makes no sense at all to say, "Well, let's just
> consider the strongest possible attack."
> 
>    Eli

My original response was concerning an algorithm "good enough to withstand 
an opponent who has full documentation of your algorithms and methods lots 
of funds, and everything except your keys."

That opponent may, concievably, be the NSA or another person/organisation 
with access to similar resources.  The consensus seems to point to such 
an opponent as being one who could mount the "strongest possible attack".

It may not be practical to consider such a general danger when designing 
particular encryption schemes; but, it is likewise impractical to make 
sweeping generalizations concerning a given scheme's invulnerability.


Sergey

> My original response was concerning an algorithm "good enough to withstand 
> an opponent who has full documentation of your algorithms and methods lots 
> of funds, and everything except your keys."

That's what they have; what can they *do*?  As I've been trying to
get across, that is not a full specification of capabilities.
Enough.

   Eli   ebrandt@hmc.edu

> > know = 100% objective certainty
> Well, OTP gives you this.  Probabilistic encryption does too, I
> think (the original version -- not the practical version).  Quantum
> cryptography is pretty close, depending on how much trust you place
> in the laws of physics.  Granted, none of these are very useful.

Don't forget Dining Cryptographer's nets and CalShad nets.

On Thu, 3 Mar 1994 wcs@anchor.ho.att.com wrote:

> Sergey writes:
> > I have often heard it said that one should always assume that one's 
> > opponent knows everything except one's secret key.  To me, this makes no 
> > sense!  If your opponent is good enough and determined enough to get by 
> > all the layers of obscurity you may have put up, than its just one more 
> > step to getting your secret key.
> 
> If your cryptography methods are good enough to withstand an
> opponent who has full documentation of your algorithms and methods,
> lots of funds, and everything except your keys, then you don't
> need to waste your time with all the other stuff.  And if you can't
> protect a couple of keys, it doesn't really matter how much other
> security you have.

I have never heard a serious, reputable claim about the unbreakablity of 
an algorithm.  Any newbie that dares to pretend otherwise is promptly 
referred to the example of the NSA.  The biggest single purchaser of 
computer hardware, and employer of mathematicians.  Dozens of years ahead 
of public research and all classified.

The point is, that in the real world, we'll never know if our algorithms 
are "good enough to withstand an opponent who has full documentation of 
your algorithms and methods lots of funds, and everything except your keys."
This opponent need not be the NSA, per se, BTW.  With "lots of funds" 
they may have access to at least some of the NSA's findings.  And, who 
knows, the NSA may regularly hire its services out to the highest bidder.

You may trust your encryption alone, but if it ever comes to that, I'll 
hide any sensitive information I may have every way I can.  

> security-by-obscurity is a naive waste of time,

I still don't see why.

> obscurity-by-obscurity is hard to argue against real clearly :-)
> On the other hand, if your cyphertext looks like random bits anyway,
> it doesn't take a lot to make them invisible.

It certainly lookss like it takes a lot!  The Mimic function seems, to me, 
to be the only effective practical steganography application.  Most of the 
rest of the informed members of this group seem to be debating the 
relative visibility/invisibility of their respective systems.

> The real need is to make your data look like Somebody Else's Problem....

Here's to somebody elese's problems!

> 			Bill
> 


Sergey