Re: a hole in PGP

At 8:08 PM 7/31/95, Dr. Fred said:

>it is impractical to verify that there
>are no subtle back doors

Ah. I knew my undergraduate philosophy degree from good ol' Mizzou would
come in handy some day.  In the sophistry biz, the above is an informal
fallacy. It's called a disproving a negative, more popularly called the
"Flying Saucer" fallacy, as in, "prove to me that flying saucers (or PGP
trap-doors) don't exist".

I would put the rest of your rejoinder in the same class of tinker-toy
logic, Doc.

You're testing my patience. Feeling flush from my New Orleans road trip, I
went out and bought the commercial version of Eudora, filter-feature and
all, which means I'm just itching to test it. In other words, it means you
are flirting with the kill-file, the bozo-filter, more rudely, a
<plonk!ing>.

Play nice, Doc, or don't play at all.

Cheers,
Bob Hettinga







-----------------
Robert Hettinga (rah@shipwright.com)
Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131
USA (617) 323-7923
"Reality is not optional." --Thomas Sowell
>>>>Phree Phil: Email: zldf@clark.net  http://www.netresponse.com/zldf <<<<<

> 
> At 8:08 PM 7/31/95, Dr. Fred said:
> 
> >it is impractical to verify that there
> >are no subtle back doors
> 
> Ah. I knew my undergraduate philosophy degree from good ol' Mizzou would
> come in handy some day.  In the sophistry biz, the above is an informal
> fallacy. It's called a disproving a negative, more popularly called the
> "Flying Saucer" fallacy, as in, "prove to me that flying saucers (or PGP
> trap-doors) don't exist".

More accurately, you cannot prove a forall statement about an infinite
set by demonstrating examples - but you can disprove it with a single
refutation, however, your argument is incorrect in this context.

Since computers current digital computers (and programs) are (close to)
finite state machines, we can prove many forall statements.  But even
more to the point, it is the job of the person asking you to trust them
to justify that trust.  If you trust them with a less-than-adequate
basis, you have only yourself to blame when you get burned. 

> I would put the rest of your rejoinder in the same class of tinker-toy
> logic, Doc.

That's me - a tinker-toy logician.  But why do you believe that PGP can be
trusted?  Because someone told you so in email on an Internet forum?  I
would hate to bet billions of dollars a day and the lives of hundreds of
thousands of people on that judgement.

> You're testing my patience. Feeling flush from my New Orleans road trip, I
> went out and bought the commercial version of Eudora, filter-feature and
> all, which means I'm just itching to test it. In other words, it means you
> are flirting with the kill-file, the bozo-filter, more rudely, a
> <plonk!ing>.

Ah!!! A threat.  You should be aware that threatening homocide is a form
of assault.  I will be certain to tell the FBI your exact words...  "the
kill-file, the bozo-filter, more rudely, a <plonk!ing>." sounds to me
(and may well sound to them) like a threat to commit murder. 

> Play nice, Doc, or don't play at all.

I am being nice, but you are not.  Perhaps you should consider
addressing the issues.

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

From: fc@all.net (Dr. Frederick B. Cohen)
   Date: Mon, 31 Jul 1995 21:03:49 -0400 (EDT)

   More accurately, you cannot prove a forall statement about an infinite
   set by demonstrating examples - but you can disprove it with a single
   refutation, however, your argument is incorrect in this context.

   Since computers current digital computers (and programs) are (close to)
   finite state machines, we can prove many forall statements.  But even

We can prove some "forall" statements; however, it is hard to tell
in advance whether any "forall" statement is one of these easily
provable or disprovable problems.

This is informally known as the halting problem.

   more to the point, it is the job of the person asking you to trust them
   to justify that trust.  If you trust them with a less-than-adequate
   basis, you have only yourself to blame when you get burned. 

Most of us consider the release of possibly imcriminating source code
to be a sign that the persons involved are worthy of trust.

Phil

-----BEGIN PGP SIGNED MESSAGE-----

My response to Dr. Frederick B. Cohen:


I rarely write ANYTHING to the list unless I think it's absolutly
necessary and has a semblence of Crypto (keeps the SNR down).
I'm looking forward to doing something similar to the crack RC4
thing again.
Anyway, after reading the crap below I have been forced to comment.
For an individual that parades the title of Doctor (and the indication 
of intelligence that title should imply) you seem to lack the grasp of what
has been stated over and over again. If you can't study the source code,
find somone that you trust that can! Prove it *doesn't* work before you
knock it.  
Lastly, this interpretation of a threat from being added to a killfile
was the last straw.
Tell the FBI I sent the following Dr.Cohen :   PLONK!
I never play nice.

ObCypherpunk: Anybody heard from Detweiller?


[snipped]

> > You're testing my patience. Feeling flush from my New Orleans road trip, I
> > went out and bought the commercial version of Eudora, filter-feature and
> > all, which means I'm just itching to test it. In other words, it means you
> > are flirting with the kill-file, the bozo-filter, more rudely, a
> > <plonk!ing>.
> 
> Ah!!! A threat.  You should be aware that threatening homocide is a form
> of assault.  I will be certain to tell the FBI your exact words...  "the
> kill-file, the bozo-filter, more rudely, a <plonk!ing>." sounds to me
> (and may well sound to them) like a threat to commit murder. 
> 
> > Play nice, Doc, or don't play at all.
> 
> I am being nice, but you are not.  Perhaps you should consider
> addressing the issues.
> 
> -- 
> -> See: Info-Sec Heaven at URL http://all.net
> Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236
> 


- -- 
==========================================================================
         PGP Public Keys: 1024/BEB3ED71 & 2047/D9E1F2E9 on request.
           As soon as any man says of the affairs of the state 
    " What does it matter to me? " the state may be given up for lost.
                    J.J.Rousseau - The Social Contract
GAT/E/O d++@>- H--- s: a29 C+++$ UL++++($) P+>+++ L++>++++ E W+++ N++ K- 
w---- O- M- V-- PS+ PE++ Y+ PGP+++ t 5+ X R* tv b++ DI++ D++ G++ e h+ r 
y++ [Geek Code v3.0] a.k.a [ root@magus.dgsys.com / vamagus@delphi.com]
==========================================================================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Protect Your Privacy. Use PGP for all your E-mail security needs!

iQCVAwUBMB2UCLbmxeO+s+1xAQE4fAP/TbNWs17V0U8SVDpp6yaCFGnGelSt4mTL
rXFSChLRtiMq/TevfTi9xmDl0j0gDeXORcpQBWlDi0ZfoownpDxHJJab7u97KlB3
WFho1WGWMXU5kyz+g6HBayPHpckH035R4rmCvGZ1zw1qph2v9NzoDhR+8pTgkCYD
7bOQYV6CKMM=
=K1aG
-----END PGP SIGNATURE-----

...
> Anyway, after reading the crap below I have been forced to comment.
> For an individual that parades the title of Doctor (and the indication 
> of intelligence that title should imply) you seem to lack the grasp of what
> has been stated over and over again. If you can't study the source code,
> find somone that you trust that can! Prove it *doesn't* work before you
> knock it.  

So you claim that software is secure unless it has been shown to be
insecure, while I claim it is insecure unless it has been shown to be
secure.  Which position do you think more sensible? (rhetorical
question, does not require any responses). 

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

On Mon, 31 Jul 1995, Dr. Frederick B. Cohen wrote:

> That's me - a tinker-toy logician.  But why do you believe that PGP can be
> trusted?  Because someone told you so in email on an Internet forum?  I
> would hate to bet billions of dollars a day and the lives of hundreds of
> thousands of people on that judgement.

Oh, yeah, right...

> > You're testing my patience. Feeling flush from my New Orleans road trip, I
> > went out and bought the commercial version of Eudora, filter-feature and
> > all, which means I'm just itching to test it. In other words, it means you
> > are flirting with the kill-file, the bozo-filter, more rudely, a
> > <plonk!ing>.
> 
> Ah!!! A threat.  You should be aware that threatening homocide is a form
> of assault.  I will be certain to tell the FBI your exact words...  "the
> kill-file, the bozo-filter, more rudely, a <plonk!ing>." sounds to me
> (and may well sound to them) like a threat to commit murder. 

Just goes to show you that you really CAN tell the idiots on the net - 
they usually sign some sort of pompous title before their name.
--
Ed Carp, N7EKG    			Ed.Carp@linux.org, ecarp@netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp@netcom.com for PGP 2.5 public key		an88744@anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.